@mastra/server 1.57.0-alpha.1 → 1.57.0

package/dist/{builder-registry-DaPvPspl.js.map → builder-registry-DE5w7bNk.js.map}

@@ -1 +1 @@
-{"version":3,"file":"builder-registry-DaPvPspl.js","names":[],"sources":["../src/server/schemas/builder-registry.ts","../src/server/handlers/builder-registry.ts"],"sourcesContent":["/**\n * Builder Registry Schemas\n *\n * Schemas for the Agent Builder skill registry routes. These are distinct from\n * the workspace skills.sh proxy schemas because:\n *   - Builder routes are not scoped to a workspace.\n *   - Builder install does not accept a `mount` field.\n *   - Builder install body carries visibility + the resolved registry id.\n *   - Builder install response returns the created stored skill id.\n *\n * The upstream skills.sh proxy response shapes are reused via the shared\n * `skillsShSearchResponseSchema`, `skillsShListResponseSchema`, and\n * `skillsShPreviewResponseSchema` since the wire shape from skills.sh is\n * registry-independent.\n */\n\nimport { z } from 'zod/v4';\n\n// =============================================================================\n// Registry list\n// =============================================================================\n\n/** Single entry in the registries list. */\nexport const builderRegistryEntrySchema = z.object({\n  id: z.literal('skills-sh').describe('Stable registry identifier'),\n  enabled: z.boolean().describe('Whether this registry is enabled in the running deployment'),\n  label: z.string().describe('Human-readable registry name'),\n});\n\n/** Response for `GET /editor/builder/registries`. */\nexport const builderRegistriesResponseSchema = z.object({\n  registries: z.array(builderRegistryEntrySchema),\n});\n\n// =============================================================================\n// Search / popular / preview\n// =============================================================================\n\n/** Path params used by every per-registry route. */\nexport const builderRegistryPathParams = z.object({\n  registryId: z.string().describe('Registry identifier (e.g. \"skills-sh\")'),\n});\n\nexport const builderRegistrySearchQuerySchema = z.object({\n  q: z.string().describe('Search query'),\n  limit: z.coerce.number().int().min(1).max(100).optional().default(10).describe('Maximum number of results (1-100)'),\n});\n\nexport const builderRegistryPopularQuerySchema = z\n  .object({\n    limit: z.coerce.number().int().min(1).max(100).optional().default(10).describe('Maximum number of results (1-100)'),\n    offset: z.coerce\n      .number()\n      .int()\n      .min(0)\n      .optional()\n      .default(0)\n      .describe('Offset for pagination (must be a multiple of `limit`)'),\n  })\n  .refine(args => args.offset % args.limit === 0, {\n    message: 'offset must be a multiple of limit (the upstream registry pages by `limit`)',\n    path: ['offset'],\n  });\n\nexport const builderRegistryPreviewQuerySchema = z.object({\n  owner: z.string().describe('GitHub repository owner'),\n  repo: z.string().describe('GitHub repository name'),\n  path: z.string().describe('Skill name within repo'),\n});\n\n// =============================================================================\n// Install\n// =============================================================================\n\n/**\n * Body for `POST /editor/builder/registries/:registryId/install`.\n *\n * Visibility behaves like the standard stored-skill create flow: optional,\n * defaults to private when the caller is authenticated.\n */\nexport const builderRegistryInstallBodySchema = z.object({\n  owner: z.string().describe('GitHub repository owner'),\n  repo: z.string().describe('GitHub repository name'),\n  skillName: z.string().describe('Skill name from the registry'),\n  visibility: z.enum(['private', 'public']).optional().describe('Visibility for the new stored skill'),\n});\n\n/** Response for the install route. Mirrors stored-skill identity fields. */\nexport const builderRegistryInstallResponseSchema = z.object({\n  storedSkillId: z.string().describe('Id of the newly created stored skill'),\n  name: z.string().describe('Resolved skill name'),\n  filesWritten: z.number().describe('Number of files materialized into the skill version snapshot'),\n});\n\nexport type BuilderRegistryEntry = z.infer<typeof builderRegistryEntrySchema>;\nexport type BuilderRegistriesResponse = z.infer<typeof builderRegistriesResponseSchema>;\nexport type BuilderRegistryInstallBody = z.infer<typeof builderRegistryInstallBodySchema>;\nexport type BuilderRegistryInstallResponse = z.infer<typeof builderRegistryInstallResponseSchema>;\n","/**\n * Builder Registry Handlers\n *\n * Routes that let admins browse and install skills from configured external\n * registries (currently just skills.sh) directly into the Builder's stored\n * skills DB. Distinct from the workspace skills.sh routes, which write to a\n * workspace filesystem and never touch storage.\n *\n * Registry availability is driven by `AgentBuilderOptions.registries`. When\n * the requested registry is disabled (or the builder is missing entirely),\n * the routes 404 instead of leaking the surface.\n */\n\nimport type { Mastra } from '@mastra/core';\nimport type { StorageSkillFileNode } from '@mastra/core/storage';\n\nimport { HTTPException } from '../http-exception';\nimport {\n  builderRegistriesResponseSchema,\n  builderRegistryInstallBodySchema,\n  builderRegistryInstallResponseSchema,\n  builderRegistryPathParams,\n  builderRegistryPopularQuerySchema,\n  builderRegistryPreviewQuerySchema,\n  builderRegistrySearchQuerySchema,\n} from '../schemas/builder-registry';\nimport {\n  skillsShListResponseSchema,\n  skillsShPreviewResponseSchema,\n  skillsShSearchResponseSchema,\n} from '../schemas/workspace';\nimport { createRoute } from '../server-adapter/routes/route-builder';\nimport { toSlug } from '../utils';\nimport { getCallerAuthorId } from './authorship';\nimport { handleError } from './error';\nimport {\n  assertSafeFilePath,\n  assertSafeSkillName,\n  fetchSkillFiles,\n  getPopularSkillsSh,\n  previewSkillsSh,\n  searchSkillsSh,\n} from './skills-sh-shared';\n\n// =============================================================================\n// Registry resolution\n// =============================================================================\n\n/** Stable identifiers + display labels for every supported registry. */\nconst REGISTRY_LABELS: Record<string, string> = {\n  'skills-sh': 'skills.sh',\n};\n\ninterface RegistryStatus {\n  id: 'skills-sh';\n  enabled: boolean;\n  label: string;\n}\n\n/**\n * Resolve which registries are enabled for the running deployment by reading\n * the builder's `registries` config. Returns a list with all known registries\n * (so the frontend can render an empty/disabled state) plus their enabled\n * flag.\n */\nasync function resolveRegistries(mastra: Mastra): Promise<RegistryStatus[]> {\n  const editor = mastra.getEditor();\n  if (!editor || typeof editor.resolveBuilder !== 'function') {\n    return [{ id: 'skills-sh', enabled: false, label: REGISTRY_LABELS['skills-sh']! }];\n  }\n  const builder = await editor.resolveBuilder();\n  const registries = builder?.getRegistries?.();\n  return [\n    {\n      id: 'skills-sh',\n      enabled: registries?.skillsSh?.enabled === true,\n      label: REGISTRY_LABELS['skills-sh']!,\n    },\n  ];\n}\n\n/**\n * Hard-gate: throws 404 when the requested registry is unknown or disabled.\n * Mirrors `requireBuilderFeature` semantics — no surface leak for OFF registries.\n */\nasync function requireEnabledRegistry(mastra: Mastra, registryId: string): Promise<void> {\n  const list = await resolveRegistries(mastra);\n  const match = list.find(r => r.id === registryId);\n  if (!match || !match.enabled) {\n    throw new HTTPException(404, { message: 'Registry not found' });\n  }\n}\n\n// =============================================================================\n// File-tree helpers\n// =============================================================================\n\n/**\n * Convert a flat list of `{ path, content, encoding }` entries into the\n * `StorageSkillFileNode` tree shape expected by the stored-skills create path.\n *\n * Each path is validated via `assertSafeFilePath` to prevent traversal from\n * upstream-controlled responses. Folder nodes are created on demand.\n */\nfunction buildFileTree(\n  files: Array<{ path: string; content: string; encoding: 'utf-8' | 'base64' }>,\n): StorageSkillFileNode[] {\n  const root: StorageSkillFileNode[] = [];\n\n  for (const file of files) {\n    const safePath = assertSafeFilePath(file.path);\n    const segments = safePath.split('/').filter(Boolean);\n    if (segments.length === 0) continue;\n\n    let cursor = root;\n    for (let i = 0; i < segments.length - 1; i++) {\n      const segment = segments[i]!;\n      let folder = cursor.find(node => node.type === 'folder' && node.name === segment);\n      if (!folder) {\n        folder = { name: segment, type: 'folder', children: [] };\n        cursor.push(folder);\n      }\n      if (!folder.children) folder.children = [];\n      cursor = folder.children;\n    }\n\n    const fileName = segments[segments.length - 1]!;\n    const content = file.encoding === 'base64' ? Buffer.from(file.content, 'base64').toString('utf-8') : file.content;\n    cursor.push({ name: fileName, type: 'file', content });\n  }\n\n  return root;\n}\n\n/**\n * Locally-bound SKILL.md frontmatter parser.\n *\n * Mirrors `parseSkillSnapshotFromFiles` from `@mastra/core/workspace`, but\n * inlined here because the server package's `@mastra/core` peer floor\n * (>=1.32.0) predates that helper. Once the floor is bumped to a release\n * containing the helper, this can be replaced by the shared core import.\n *\n * Only SKILL.md is consulted — frontmatter is split from the body using a\n * minimal YAML key:value reader sufficient for the fields registries\n * actually use (name, description). The body is everything after the\n * second `---` line, trimmed.\n */\ntype ParsedSkillSnapshot = {\n  name?: string;\n  description?: string;\n  instructions: string;\n};\n\nfunction parseSkillSnapshot(\n  files: Array<{ path: string; content: string; encoding: 'utf-8' | 'base64' }>,\n): ParsedSkillSnapshot | null {\n  const skillMd = files.find(f => f.path === 'SKILL.md');\n  if (!skillMd) return null;\n\n  const raw =\n    skillMd.encoding === 'base64' ? Buffer.from(skillMd.content, 'base64').toString('utf-8') : skillMd.content;\n\n  const fmMatch = raw.match(/^---\\r?\\n([\\s\\S]*?)\\r?\\n---\\r?\\n?([\\s\\S]*)$/);\n  if (!fmMatch) {\n    return { instructions: raw.trim() };\n  }\n\n  const fmBlock = fmMatch[1] ?? '';\n  const body = fmMatch[2] ?? '';\n  const frontmatter: Record<string, string> = {};\n  for (const line of fmBlock.split(/\\r?\\n/)) {\n    const m = line.match(/^([A-Za-z0-9_-]+)\\s*:\\s*(.*)$/);\n    if (!m) continue;\n    const key = m[1];\n    const value = m[2] ?? '';\n    if (!key) continue;\n    // Strip surrounding quotes, leave the rest as-is. Registry SKILL.md\n    // frontmatter is consistently flat string fields in practice.\n    frontmatter[key] = value.trim().replace(/^[\"'](.*)[\"']$/, '$1');\n  }\n\n  return {\n    name: frontmatter.name,\n    description: frontmatter.description,\n    instructions: body.trim(),\n  };\n}\n\n// =============================================================================\n// Routes\n// =============================================================================\n\n/**\n * GET /editor/builder/registries\n *\n * Lists every known registry and whether it's enabled in this deployment.\n * Used by the Builder UI to decide whether to show the \"Browse registry\"\n * entry point at all.\n */\nexport const LIST_BUILDER_REGISTRIES_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/builder/registries',\n  responseType: 'json',\n  responseSchema: builderRegistriesResponseSchema,\n  summary: 'List available skill registries',\n  description: 'Returns the configured external skill registries and their enabled state.',\n  tags: ['Editor'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:read',\n  handler: async ({ mastra }) => {\n    try {\n      const registries = await resolveRegistries(mastra);\n      return { registries };\n    } catch (error) {\n      return handleError(error, 'Error listing builder registries');\n    }\n  },\n});\n\n/**\n * GET /editor/builder/registries/:registryId/search\n *\n * Proxies a search query to the underlying registry. Currently only\n * registryId=\"skills-sh\" is supported.\n */\nexport const BUILDER_REGISTRY_SEARCH_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/builder/registries/:registryId/search',\n  responseType: 'json',\n  pathParamSchema: builderRegistryPathParams,\n  queryParamSchema: builderRegistrySearchQuerySchema,\n  responseSchema: skillsShSearchResponseSchema,\n  summary: 'Search skills in a registry',\n  description: 'Proxies a search request to the configured registry to avoid CORS issues.',\n  tags: ['Editor', 'Skills'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:read',\n  handler: async ({ mastra, registryId, q, limit }) => {\n    try {\n      await requireEnabledRegistry(mastra, registryId);\n      return await searchSkillsSh({ q, limit });\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      return handleError(error, 'Error searching registry');\n    }\n  },\n});\n\n/**\n * GET /editor/builder/registries/:registryId/popular\n *\n * Returns the most popular skills in a registry.\n */\nexport const BUILDER_REGISTRY_POPULAR_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/builder/registries/:registryId/popular',\n  responseType: 'json',\n  pathParamSchema: builderRegistryPathParams,\n  queryParamSchema: builderRegistryPopularQuerySchema,\n  responseSchema: skillsShListResponseSchema,\n  summary: 'Get popular skills from a registry',\n  description: 'Proxies a popular-skills request to the configured registry to avoid CORS issues.',\n  tags: ['Editor', 'Skills'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:read',\n  handler: async ({ mastra, registryId, limit, offset }) => {\n    try {\n      await requireEnabledRegistry(mastra, registryId);\n      return await getPopularSkillsSh({ limit, offset });\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      return handleError(error, 'Error fetching popular skills');\n    }\n  },\n});\n\n/**\n * GET /editor/builder/registries/:registryId/preview\n *\n * Returns the rendered SKILL.md content for a single skill in the registry.\n */\nexport const BUILDER_REGISTRY_PREVIEW_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/builder/registries/:registryId/preview',\n  responseType: 'json',\n  pathParamSchema: builderRegistryPathParams,\n  queryParamSchema: builderRegistryPreviewQuerySchema,\n  responseSchema: skillsShPreviewResponseSchema,\n  summary: 'Preview a skill from a registry',\n  description: 'Fetches the SKILL.md content for a single skill in the configured registry.',\n  tags: ['Editor', 'Skills'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:read',\n  handler: async ({ mastra, registryId, owner, repo, path: skillName }) => {\n    try {\n      await requireEnabledRegistry(mastra, registryId);\n      return await previewSkillsSh({ owner, repo, skillName });\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      return handleError(error, 'Error fetching skill preview');\n    }\n  },\n});\n\n/**\n * POST /editor/builder/registries/:registryId/install\n *\n * Fetches the full file tree for a skill from the registry, parses the\n * SKILL.md frontmatter for name/description, and persists everything as a\n * new stored skill. The registry origin is recorded under `metadata.origin`\n * so the UI can surface \"imported from skills.sh\" badges and re-resolve the\n * source later.\n *\n * Collisions (a stored skill with the derived id already exists) return 409\n * so the UI can offer an \"Open existing\" link instead of silently\n * overwriting.\n */\nexport const BUILDER_REGISTRY_INSTALL_ROUTE = createRoute({\n  method: 'POST',\n  path: '/editor/builder/registries/:registryId/install',\n  responseType: 'json',\n  pathParamSchema: builderRegistryPathParams,\n  bodySchema: builderRegistryInstallBodySchema,\n  responseSchema: builderRegistryInstallResponseSchema,\n  summary: 'Install a registry skill into stored skills',\n  description: 'Fetches a skill from the configured registry and persists it as a new stored skill.',\n  tags: ['Editor', 'Skills'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:write',\n  handler: async ({ mastra, requestContext, registryId, owner, repo, skillName, visibility: bodyVisibility }) => {\n    try {\n      await requireEnabledRegistry(mastra, registryId);\n\n      const storage = mastra.getStorage();\n      if (!storage) {\n        throw new HTTPException(500, { message: 'Storage is not configured' });\n      }\n      const skillStore = await storage.getStore('skills');\n      if (!skillStore) {\n        throw new HTTPException(500, { message: 'Skills storage domain is not available' });\n      }\n\n      // Pull files from the registry\n      const result = await fetchSkillFiles(owner, repo, skillName);\n      if (!result || result.files.length === 0) {\n        throw new HTTPException(404, {\n          message: `Could not find skill \"${skillName}\" in ${owner}/${repo}.`,\n        });\n      }\n\n      const safeSkillId = assertSafeSkillName(result.skillId);\n      const files = buildFileTree(result.files);\n\n      // Parse SKILL.md frontmatter into structured fields. Splitting\n      // frontmatter (name/description) from the markdown body keeps the\n      // body as the agent-facing `instructions` instead of polluting it\n      // with raw YAML metadata. SKILL.md missing or unparseable simply\n      // yields a null snapshot — registry-provided values then fill in.\n      const snapshot = parseSkillSnapshot(result.files);\n\n      const resolvedName = snapshot?.name ?? safeSkillId;\n      const description = snapshot?.description ?? `Imported from ${owner}/${repo}`;\n      const id = toSlug(resolvedName) || safeSkillId;\n\n      if (!id) {\n        throw new HTTPException(400, {\n          message: 'Could not derive skill ID from registry skill metadata.',\n        });\n      }\n\n      // Reject collisions instead of silently overwriting; UI offers \"Open existing\".\n      const existing = await skillStore.getById(id);\n      if (existing) {\n        throw new HTTPException(409, {\n          message: `Skill with id \"${id}\" already exists.`,\n          // Surface the existing id so the client can deep-link.\n          cause: { storedSkillId: id },\n        });\n      }\n\n      // Match the standard create flow: no caller = always public, otherwise default private.\n      const authorId = getCallerAuthorId(requestContext) ?? undefined;\n      const visibility: 'private' | 'public' = authorId ? (bodyVisibility ?? 'private') : 'public';\n\n      // Use the SKILL.md body (post-frontmatter) as instructions. Frontmatter\n      // values are already lifted into structured columns above, so re-storing\n      // them in `instructions` would both duplicate metadata and feed YAML\n      // into the agent's prompt. Fall back to description when no usable body\n      // exists so `resolved.snapshot.instructions` stays non-empty.\n      const instructions = snapshot?.instructions?.trim() ? snapshot.instructions : description;\n\n      await skillStore.create({\n        skill: {\n          id,\n          authorId,\n          visibility,\n          name: resolvedName,\n          description,\n          instructions,\n          files,\n          metadata: {\n            origin: {\n              type: 'skills-sh',\n              owner,\n              repo,\n              skillName,\n            },\n          },\n        },\n      });\n\n      return {\n        storedSkillId: id,\n        name: resolvedName,\n        filesWritten: result.files.length,\n      };\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      return handleError(error, 'Error installing registry skill');\n    }\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,6BAA6B,EAAE,OAAO;CACjD,IAAI,EAAE,QAAQ,WAAW,CAAC,CAAC,SAAS,4BAA4B;CAChE,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS,4DAA4D;CAC1F,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,8BAA8B;AAC3D,CAAC;;AAGD,MAAa,kCAAkC,EAAE,OAAO,EACtD,YAAY,EAAE,MAAM,0BAA0B,EAChD,CAAC;;AAOD,MAAa,4BAA4B,EAAE,OAAO,EAChD,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS,0CAAwC,EAC1E,CAAC;AAED,MAAa,mCAAmC,EAAE,OAAO;CACvD,GAAG,EAAE,OAAO,CAAC,CAAC,SAAS,cAAc;CACrC,OAAO,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,mCAAmC;AACpH,CAAC;AAED,MAAa,oCAAoC,EAC9C,OAAO;CACN,OAAO,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,mCAAmC;CAClH,QAAQ,EAAE,OACP,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC,CACV,SAAS,uDAAuD;AACrE,CAAC,CAAC,CACD,QAAO,SAAQ,KAAK,SAAS,KAAK,UAAU,GAAG;CAC9C,SAAS;CACT,MAAM,CAAC,QAAQ;AACjB,CAAC;AAEH,MAAa,oCAAoC,EAAE,OAAO;CACxD,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,yBAAyB;CACpD,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,wBAAwB;CAClD,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,wBAAwB;AACpD,CAAC;;;;;;;AAYD,MAAa,mCAAmC,EAAE,OAAO;CACvD,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,yBAAyB;CACpD,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,wBAAwB;CAClD,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS,8BAA8B;CAC7D,YAAY,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,qCAAqC;AACrG,CAAC;;AAGD,MAAa,uCAAuC,EAAE,OAAO;CAC3D,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS,sCAAsC;CACzE,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,qBAAqB;CAC/C,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS,8DAA8D;AAClG,CAAC;;;;AC3CD,MAAM,kBAA0C,EAC9C,aAAa,YACf;;;;;;;AAcA,eAAe,kBAAkB,QAA2C;CAC1E,MAAM,SAAS,OAAO,UAAU;CAChC,IAAI,CAAC,UAAU,OAAO,OAAO,mBAAmB,YAC9C,OAAO,CAAC;EAAE,IAAI;EAAa,SAAS;EAAO,OAAO,gBAAgB;CAAc,CAAC;CAInF,OAAO,CACL;EACE,IAAI;EACJ,WAJe,MADG,OAAO,eAAe,EAAA,EAChB,gBAAgB,EAAA,EAInB,UAAU,YAAY;EAC3C,OAAO,gBAAgB;CACzB,CACF;AACF;;;;;AAMA,eAAe,uBAAuB,QAAgB,YAAmC;CAEvF,MAAM,SAAQ,MADK,kBAAkB,MAAM,EAAA,CACxB,MAAK,MAAK,EAAE,OAAO,UAAU;CAChD,IAAI,CAAC,SAAS,CAAC,MAAM,SACnB,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,qBAAqB,CAAC;AAElE;;;;;;;;AAaA,SAAS,cACP,OACwB;CACxB,MAAM,OAA+B,CAAC;CAEtC,KAAK,MAAM,QAAQ,OAAO;EAExB,MAAM,WADW,mBAAmB,KAAK,IACjB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;EACnD,IAAI,SAAS,WAAW,GAAG;EAE3B,IAAI,SAAS;EACb,KAAK,IAAI,IAAI,GAAG,IAAI,SAAS,SAAS,GAAG,KAAK;GAC5C,MAAM,UAAU,SAAS;GACzB,IAAI,SAAS,OAAO,MAAK,SAAQ,KAAK,SAAS,YAAY,KAAK,SAAS,OAAO;GAChF,IAAI,CAAC,QAAQ;IACX,SAAS;KAAE,MAAM;KAAS,MAAM;KAAU,UAAU,CAAC;IAAE;IACvD,OAAO,KAAK,MAAM;GACpB;GACA,IAAI,CAAC,OAAO,UAAU,OAAO,WAAW,CAAC;GACzC,SAAS,OAAO;EAClB;EAEA,MAAM,WAAW,SAAS,SAAS,SAAS;EAC5C,MAAM,UAAU,KAAK,aAAa,WAAW,OAAO,KAAK,KAAK,SAAS,QAAQ,CAAC,CAAC,SAAS,OAAO,IAAI,KAAK;EAC1G,OAAO,KAAK;GAAE,MAAM;GAAU,MAAM;GAAQ;EAAQ,CAAC;CACvD;CAEA,OAAO;AACT;AAqBA,SAAS,mBACP,OAC4B;CAC5B,MAAM,UAAU,MAAM,MAAK,MAAK,EAAE,SAAS,UAAU;CACrD,IAAI,CAAC,SAAS,OAAO;CAErB,MAAM,MACJ,QAAQ,aAAa,WAAW,OAAO,KAAK,QAAQ,SAAS,QAAQ,CAAC,CAAC,SAAS,OAAO,IAAI,QAAQ;CAErG,MAAM,UAAU,IAAI,MAAM,6CAA6C;CACvE,IAAI,CAAC,SACH,OAAO,EAAE,cAAc,IAAI,KAAK,EAAE;CAGpC,MAAM,UAAU,QAAQ,MAAM;CAC9B,MAAM,OAAO,QAAQ,MAAM;CAC3B,MAAM,cAAsC,CAAC;CAC7C,KAAK,MAAM,QAAQ,QAAQ,MAAM,OAAO,GAAG;EACzC,MAAM,IAAI,KAAK,MAAM,+BAA+B;EACpD,IAAI,CAAC,GAAG;EACR,MAAM,MAAM,EAAE;EACd,MAAM,QAAQ,EAAE,MAAM;EACtB,IAAI,CAAC,KAAK;EAGV,YAAY,OAAO,MAAM,KAAK,CAAC,CAAC,QAAQ,kBAAkB,IAAI;CAChE;CAEA,OAAO;EACL,MAAM,YAAY;EAClB,aAAa,YAAY;EACzB,cAAc,KAAK,KAAK;CAC1B;AACF;;;;;;;;AAaA,MAAa,gCAAgC,YAAY;CACvD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,QAAQ;CACf,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,aAAa;EAC7B,IAAI;GAEF,OAAO,EAAE,YAAA,MADgB,kBAAkB,MAAM,EAC7B;EACtB,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,kCAAkC;EAC9D;CACF;AACF,CAAC;;;;;;;AAQD,MAAa,gCAAgC,YAAY;CACvD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,QAAQ;CACzB,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,YAAY,GAAG,YAAY;EACnD,IAAI;GACF,MAAM,uBAAuB,QAAQ,UAAU;GAC/C,OAAO,MAAM,eAAe;IAAE;IAAG;GAAM,CAAC;EAC1C,SAAS,OAAO;GACd,IAAI,iBAAiB,eAAe,MAAM;GAC1C,OAAO,YAAY,OAAO,0BAA0B;EACtD;CACF;AACF,CAAC;;;;;;AAOD,MAAa,iCAAiC,YAAY;CACxD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,QAAQ;CACzB,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,YAAY,OAAO,aAAa;EACxD,IAAI;GACF,MAAM,uBAAuB,QAAQ,UAAU;GAC/C,OAAO,MAAM,mBAAmB;IAAE;IAAO;GAAO,CAAC;EACnD,SAAS,OAAO;GACd,IAAI,iBAAiB,eAAe,MAAM;GAC1C,OAAO,YAAY,OAAO,+BAA+B;EAC3D;CACF;AACF,CAAC;;;;;;AAOD,MAAa,iCAAiC,YAAY;CACxD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,QAAQ;CACzB,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,YAAY,OAAO,MAAM,MAAM,gBAAgB;EACvE,IAAI;GACF,MAAM,uBAAuB,QAAQ,UAAU;GAC/C,OAAO,MAAM,gBAAgB;IAAE;IAAO;IAAM;GAAU,CAAC;EACzD,SAAS,OAAO;GACd,IAAI,iBAAiB,eAAe,MAAM;GAC1C,OAAO,YAAY,OAAO,8BAA8B;EAC1D;CACF;AACF,CAAC;;;;;;;;;;;;;;AAeD,MAAa,iCAAiC,YAAY;CACxD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,YAAY;CACZ,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,QAAQ;CACzB,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,gBAAgB,YAAY,OAAO,MAAM,WAAW,YAAY,qBAAqB;EAC7G,IAAI;GACF,MAAM,uBAAuB,QAAQ,UAAU;GAE/C,MAAM,UAAU,OAAO,WAAW;GAClC,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,4BAA4B,CAAC;GAEvE,MAAM,aAAa,MAAM,QAAQ,SAAS,QAAQ;GAClD,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,yCAAyC,CAAC;GAIpF,MAAM,SAAS,MAAM,gBAAgB,OAAO,MAAM,SAAS;GAC3D,IAAI,CAAC,UAAU,OAAO,MAAM,WAAW,GACrC,MAAM,IAAI,cAAc,KAAK,EAC3B,SAAS,yBAAyB,UAAU,OAAO,MAAM,GAAG,KAAK,GACnE,CAAC;GAGH,MAAM,cAAc,oBAAoB,OAAO,OAAO;GACtD,MAAM,QAAQ,cAAc,OAAO,KAAK;GAOxC,MAAM,WAAW,mBAAmB,OAAO,KAAK;GAEhD,MAAM,eAAe,UAAU,QAAQ;GACvC,MAAM,cAAc,UAAU,eAAe,iBAAiB,MAAM,GAAG;GACvE,MAAM,KAAK,OAAO,YAAY,KAAK;GAEnC,IAAI,CAAC,IACH,MAAM,IAAI,cAAc,KAAK,EAC3B,SAAS,0DACX,CAAC;GAKH,IAAI,MADmB,WAAW,QAAQ,EAAE,GAE1C,MAAM,IAAI,cAAc,KAAK;IAC3B,SAAS,kBAAkB,GAAG;IAE9B,OAAO,EAAE,eAAe,GAAG;GAC7B,CAAC;GAIH,MAAM,WAAW,kBAAkB,cAAc,KAAK,KAAA;GACtD,MAAM,aAAmC,WAAY,kBAAkB,YAAa;GAOpF,MAAM,eAAe,UAAU,cAAc,KAAK,IAAI,SAAS,eAAe;GAE9E,MAAM,WAAW,OAAO,EACtB,OAAO;IACL;IACA;IACA;IACA,MAAM;IACN;IACA;IACA;IACA,UAAU,EACR,QAAQ;KACN,MAAM;KACN;KACA;KACA;IACF,EACF;GACF,EACF,CAAC;GAED,OAAO;IACL,eAAe;IACf,MAAM;IACN,cAAc,OAAO,MAAM;GAC7B;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,eAAe,MAAM;GAC1C,OAAO,YAAY,OAAO,iCAAiC;EAC7D;CACF;AACF,CAAC"}
+{"version":3,"file":"builder-registry-DE5w7bNk.js","names":[],"sources":["../src/server/schemas/builder-registry.ts","../src/server/handlers/builder-registry.ts"],"sourcesContent":["/**\n * Builder Registry Schemas\n *\n * Schemas for the Agent Builder skill registry routes. These are distinct from\n * the workspace skills.sh proxy schemas because:\n *   - Builder routes are not scoped to a workspace.\n *   - Builder install does not accept a `mount` field.\n *   - Builder install body carries visibility + the resolved registry id.\n *   - Builder install response returns the created stored skill id.\n *\n * The upstream skills.sh proxy response shapes are reused via the shared\n * `skillsShSearchResponseSchema`, `skillsShListResponseSchema`, and\n * `skillsShPreviewResponseSchema` since the wire shape from skills.sh is\n * registry-independent.\n */\n\nimport { z } from 'zod/v4';\n\n// =============================================================================\n// Registry list\n// =============================================================================\n\n/** Single entry in the registries list. */\nexport const builderRegistryEntrySchema = z.object({\n  id: z.literal('skills-sh').describe('Stable registry identifier'),\n  enabled: z.boolean().describe('Whether this registry is enabled in the running deployment'),\n  label: z.string().describe('Human-readable registry name'),\n});\n\n/** Response for `GET /editor/builder/registries`. */\nexport const builderRegistriesResponseSchema = z.object({\n  registries: z.array(builderRegistryEntrySchema),\n});\n\n// =============================================================================\n// Search / popular / preview\n// =============================================================================\n\n/** Path params used by every per-registry route. */\nexport const builderRegistryPathParams = z.object({\n  registryId: z.string().describe('Registry identifier (e.g. \"skills-sh\")'),\n});\n\nexport const builderRegistrySearchQuerySchema = z.object({\n  q: z.string().describe('Search query'),\n  limit: z.coerce.number().int().min(1).max(100).optional().default(10).describe('Maximum number of results (1-100)'),\n});\n\nexport const builderRegistryPopularQuerySchema = z\n  .object({\n    limit: z.coerce.number().int().min(1).max(100).optional().default(10).describe('Maximum number of results (1-100)'),\n    offset: z.coerce\n      .number()\n      .int()\n      .min(0)\n      .optional()\n      .default(0)\n      .describe('Offset for pagination (must be a multiple of `limit`)'),\n  })\n  .refine(args => args.offset % args.limit === 0, {\n    message: 'offset must be a multiple of limit (the upstream registry pages by `limit`)',\n    path: ['offset'],\n  });\n\nexport const builderRegistryPreviewQuerySchema = z.object({\n  owner: z.string().describe('GitHub repository owner'),\n  repo: z.string().describe('GitHub repository name'),\n  path: z.string().describe('Skill name within repo'),\n});\n\n// =============================================================================\n// Install\n// =============================================================================\n\n/**\n * Body for `POST /editor/builder/registries/:registryId/install`.\n *\n * Visibility behaves like the standard stored-skill create flow: optional,\n * defaults to private when the caller is authenticated.\n */\nexport const builderRegistryInstallBodySchema = z.object({\n  owner: z.string().describe('GitHub repository owner'),\n  repo: z.string().describe('GitHub repository name'),\n  skillName: z.string().describe('Skill name from the registry'),\n  visibility: z.enum(['private', 'public']).optional().describe('Visibility for the new stored skill'),\n});\n\n/** Response for the install route. Mirrors stored-skill identity fields. */\nexport const builderRegistryInstallResponseSchema = z.object({\n  storedSkillId: z.string().describe('Id of the newly created stored skill'),\n  name: z.string().describe('Resolved skill name'),\n  filesWritten: z.number().describe('Number of files materialized into the skill version snapshot'),\n});\n\nexport type BuilderRegistryEntry = z.infer<typeof builderRegistryEntrySchema>;\nexport type BuilderRegistriesResponse = z.infer<typeof builderRegistriesResponseSchema>;\nexport type BuilderRegistryInstallBody = z.infer<typeof builderRegistryInstallBodySchema>;\nexport type BuilderRegistryInstallResponse = z.infer<typeof builderRegistryInstallResponseSchema>;\n","/**\n * Builder Registry Handlers\n *\n * Routes that let admins browse and install skills from configured external\n * registries (currently just skills.sh) directly into the Builder's stored\n * skills DB. Distinct from the workspace skills.sh routes, which write to a\n * workspace filesystem and never touch storage.\n *\n * Registry availability is driven by `AgentBuilderOptions.registries`. When\n * the requested registry is disabled (or the builder is missing entirely),\n * the routes 404 instead of leaking the surface.\n */\n\nimport type { Mastra } from '@mastra/core';\nimport type { StorageSkillFileNode } from '@mastra/core/storage';\n\nimport { HTTPException } from '../http-exception';\nimport {\n  builderRegistriesResponseSchema,\n  builderRegistryInstallBodySchema,\n  builderRegistryInstallResponseSchema,\n  builderRegistryPathParams,\n  builderRegistryPopularQuerySchema,\n  builderRegistryPreviewQuerySchema,\n  builderRegistrySearchQuerySchema,\n} from '../schemas/builder-registry';\nimport {\n  skillsShListResponseSchema,\n  skillsShPreviewResponseSchema,\n  skillsShSearchResponseSchema,\n} from '../schemas/workspace';\nimport { createRoute } from '../server-adapter/routes/route-builder';\nimport { toSlug } from '../utils';\nimport { getCallerAuthorId } from './authorship';\nimport { handleError } from './error';\nimport {\n  assertSafeFilePath,\n  assertSafeSkillName,\n  fetchSkillFiles,\n  getPopularSkillsSh,\n  previewSkillsSh,\n  searchSkillsSh,\n} from './skills-sh-shared';\n\n// =============================================================================\n// Registry resolution\n// =============================================================================\n\n/** Stable identifiers + display labels for every supported registry. */\nconst REGISTRY_LABELS: Record<string, string> = {\n  'skills-sh': 'skills.sh',\n};\n\ninterface RegistryStatus {\n  id: 'skills-sh';\n  enabled: boolean;\n  label: string;\n}\n\n/**\n * Resolve which registries are enabled for the running deployment by reading\n * the builder's `registries` config. Returns a list with all known registries\n * (so the frontend can render an empty/disabled state) plus their enabled\n * flag.\n */\nasync function resolveRegistries(mastra: Mastra): Promise<RegistryStatus[]> {\n  const editor = mastra.getEditor();\n  if (!editor || typeof editor.resolveBuilder !== 'function') {\n    return [{ id: 'skills-sh', enabled: false, label: REGISTRY_LABELS['skills-sh']! }];\n  }\n  const builder = await editor.resolveBuilder();\n  const registries = builder?.getRegistries?.();\n  return [\n    {\n      id: 'skills-sh',\n      enabled: registries?.skillsSh?.enabled === true,\n      label: REGISTRY_LABELS['skills-sh']!,\n    },\n  ];\n}\n\n/**\n * Hard-gate: throws 404 when the requested registry is unknown or disabled.\n * Mirrors `requireBuilderFeature` semantics — no surface leak for OFF registries.\n */\nasync function requireEnabledRegistry(mastra: Mastra, registryId: string): Promise<void> {\n  const list = await resolveRegistries(mastra);\n  const match = list.find(r => r.id === registryId);\n  if (!match || !match.enabled) {\n    throw new HTTPException(404, { message: 'Registry not found' });\n  }\n}\n\n// =============================================================================\n// File-tree helpers\n// =============================================================================\n\n/**\n * Convert a flat list of `{ path, content, encoding }` entries into the\n * `StorageSkillFileNode` tree shape expected by the stored-skills create path.\n *\n * Each path is validated via `assertSafeFilePath` to prevent traversal from\n * upstream-controlled responses. Folder nodes are created on demand.\n */\nfunction buildFileTree(\n  files: Array<{ path: string; content: string; encoding: 'utf-8' | 'base64' }>,\n): StorageSkillFileNode[] {\n  const root: StorageSkillFileNode[] = [];\n\n  for (const file of files) {\n    const safePath = assertSafeFilePath(file.path);\n    const segments = safePath.split('/').filter(Boolean);\n    if (segments.length === 0) continue;\n\n    let cursor = root;\n    for (let i = 0; i < segments.length - 1; i++) {\n      const segment = segments[i]!;\n      let folder = cursor.find(node => node.type === 'folder' && node.name === segment);\n      if (!folder) {\n        folder = { name: segment, type: 'folder', children: [] };\n        cursor.push(folder);\n      }\n      if (!folder.children) folder.children = [];\n      cursor = folder.children;\n    }\n\n    const fileName = segments[segments.length - 1]!;\n    const content = file.encoding === 'base64' ? Buffer.from(file.content, 'base64').toString('utf-8') : file.content;\n    cursor.push({ name: fileName, type: 'file', content });\n  }\n\n  return root;\n}\n\n/**\n * Locally-bound SKILL.md frontmatter parser.\n *\n * Mirrors `parseSkillSnapshotFromFiles` from `@mastra/core/workspace`, but\n * inlined here because the server package's `@mastra/core` peer floor\n * (>=1.32.0) predates that helper. Once the floor is bumped to a release\n * containing the helper, this can be replaced by the shared core import.\n *\n * Only SKILL.md is consulted — frontmatter is split from the body using a\n * minimal YAML key:value reader sufficient for the fields registries\n * actually use (name, description). The body is everything after the\n * second `---` line, trimmed.\n */\ntype ParsedSkillSnapshot = {\n  name?: string;\n  description?: string;\n  instructions: string;\n};\n\nfunction parseSkillSnapshot(\n  files: Array<{ path: string; content: string; encoding: 'utf-8' | 'base64' }>,\n): ParsedSkillSnapshot | null {\n  const skillMd = files.find(f => f.path === 'SKILL.md');\n  if (!skillMd) return null;\n\n  const raw =\n    skillMd.encoding === 'base64' ? Buffer.from(skillMd.content, 'base64').toString('utf-8') : skillMd.content;\n\n  const fmMatch = raw.match(/^---\\r?\\n([\\s\\S]*?)\\r?\\n---\\r?\\n?([\\s\\S]*)$/);\n  if (!fmMatch) {\n    return { instructions: raw.trim() };\n  }\n\n  const fmBlock = fmMatch[1] ?? '';\n  const body = fmMatch[2] ?? '';\n  const frontmatter: Record<string, string> = {};\n  for (const line of fmBlock.split(/\\r?\\n/)) {\n    const m = line.match(/^([A-Za-z0-9_-]+)\\s*:\\s*(.*)$/);\n    if (!m) continue;\n    const key = m[1];\n    const value = m[2] ?? '';\n    if (!key) continue;\n    // Strip surrounding quotes, leave the rest as-is. Registry SKILL.md\n    // frontmatter is consistently flat string fields in practice.\n    frontmatter[key] = value.trim().replace(/^[\"'](.*)[\"']$/, '$1');\n  }\n\n  return {\n    name: frontmatter.name,\n    description: frontmatter.description,\n    instructions: body.trim(),\n  };\n}\n\n// =============================================================================\n// Routes\n// =============================================================================\n\n/**\n * GET /editor/builder/registries\n *\n * Lists every known registry and whether it's enabled in this deployment.\n * Used by the Builder UI to decide whether to show the \"Browse registry\"\n * entry point at all.\n */\nexport const LIST_BUILDER_REGISTRIES_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/builder/registries',\n  responseType: 'json',\n  responseSchema: builderRegistriesResponseSchema,\n  summary: 'List available skill registries',\n  description: 'Returns the configured external skill registries and their enabled state.',\n  tags: ['Editor'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:read',\n  handler: async ({ mastra }) => {\n    try {\n      const registries = await resolveRegistries(mastra);\n      return { registries };\n    } catch (error) {\n      return handleError(error, 'Error listing builder registries');\n    }\n  },\n});\n\n/**\n * GET /editor/builder/registries/:registryId/search\n *\n * Proxies a search query to the underlying registry. Currently only\n * registryId=\"skills-sh\" is supported.\n */\nexport const BUILDER_REGISTRY_SEARCH_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/builder/registries/:registryId/search',\n  responseType: 'json',\n  pathParamSchema: builderRegistryPathParams,\n  queryParamSchema: builderRegistrySearchQuerySchema,\n  responseSchema: skillsShSearchResponseSchema,\n  summary: 'Search skills in a registry',\n  description: 'Proxies a search request to the configured registry to avoid CORS issues.',\n  tags: ['Editor', 'Skills'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:read',\n  handler: async ({ mastra, registryId, q, limit }) => {\n    try {\n      await requireEnabledRegistry(mastra, registryId);\n      return await searchSkillsSh({ q, limit });\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      return handleError(error, 'Error searching registry');\n    }\n  },\n});\n\n/**\n * GET /editor/builder/registries/:registryId/popular\n *\n * Returns the most popular skills in a registry.\n */\nexport const BUILDER_REGISTRY_POPULAR_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/builder/registries/:registryId/popular',\n  responseType: 'json',\n  pathParamSchema: builderRegistryPathParams,\n  queryParamSchema: builderRegistryPopularQuerySchema,\n  responseSchema: skillsShListResponseSchema,\n  summary: 'Get popular skills from a registry',\n  description: 'Proxies a popular-skills request to the configured registry to avoid CORS issues.',\n  tags: ['Editor', 'Skills'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:read',\n  handler: async ({ mastra, registryId, limit, offset }) => {\n    try {\n      await requireEnabledRegistry(mastra, registryId);\n      return await getPopularSkillsSh({ limit, offset });\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      return handleError(error, 'Error fetching popular skills');\n    }\n  },\n});\n\n/**\n * GET /editor/builder/registries/:registryId/preview\n *\n * Returns the rendered SKILL.md content for a single skill in the registry.\n */\nexport const BUILDER_REGISTRY_PREVIEW_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/builder/registries/:registryId/preview',\n  responseType: 'json',\n  pathParamSchema: builderRegistryPathParams,\n  queryParamSchema: builderRegistryPreviewQuerySchema,\n  responseSchema: skillsShPreviewResponseSchema,\n  summary: 'Preview a skill from a registry',\n  description: 'Fetches the SKILL.md content for a single skill in the configured registry.',\n  tags: ['Editor', 'Skills'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:read',\n  handler: async ({ mastra, registryId, owner, repo, path: skillName }) => {\n    try {\n      await requireEnabledRegistry(mastra, registryId);\n      return await previewSkillsSh({ owner, repo, skillName });\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      return handleError(error, 'Error fetching skill preview');\n    }\n  },\n});\n\n/**\n * POST /editor/builder/registries/:registryId/install\n *\n * Fetches the full file tree for a skill from the registry, parses the\n * SKILL.md frontmatter for name/description, and persists everything as a\n * new stored skill. The registry origin is recorded under `metadata.origin`\n * so the UI can surface \"imported from skills.sh\" badges and re-resolve the\n * source later.\n *\n * Collisions (a stored skill with the derived id already exists) return 409\n * so the UI can offer an \"Open existing\" link instead of silently\n * overwriting.\n */\nexport const BUILDER_REGISTRY_INSTALL_ROUTE = createRoute({\n  method: 'POST',\n  path: '/editor/builder/registries/:registryId/install',\n  responseType: 'json',\n  pathParamSchema: builderRegistryPathParams,\n  bodySchema: builderRegistryInstallBodySchema,\n  responseSchema: builderRegistryInstallResponseSchema,\n  summary: 'Install a registry skill into stored skills',\n  description: 'Fetches a skill from the configured registry and persists it as a new stored skill.',\n  tags: ['Editor', 'Skills'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:write',\n  handler: async ({ mastra, requestContext, registryId, owner, repo, skillName, visibility: bodyVisibility }) => {\n    try {\n      await requireEnabledRegistry(mastra, registryId);\n\n      const storage = mastra.getStorage();\n      if (!storage) {\n        throw new HTTPException(500, { message: 'Storage is not configured' });\n      }\n      const skillStore = await storage.getStore('skills');\n      if (!skillStore) {\n        throw new HTTPException(500, { message: 'Skills storage domain is not available' });\n      }\n\n      // Pull files from the registry\n      const result = await fetchSkillFiles(owner, repo, skillName);\n      if (!result || result.files.length === 0) {\n        throw new HTTPException(404, {\n          message: `Could not find skill \"${skillName}\" in ${owner}/${repo}.`,\n        });\n      }\n\n      const safeSkillId = assertSafeSkillName(result.skillId);\n      const files = buildFileTree(result.files);\n\n      // Parse SKILL.md frontmatter into structured fields. Splitting\n      // frontmatter (name/description) from the markdown body keeps the\n      // body as the agent-facing `instructions` instead of polluting it\n      // with raw YAML metadata. SKILL.md missing or unparseable simply\n      // yields a null snapshot — registry-provided values then fill in.\n      const snapshot = parseSkillSnapshot(result.files);\n\n      const resolvedName = snapshot?.name ?? safeSkillId;\n      const description = snapshot?.description ?? `Imported from ${owner}/${repo}`;\n      const id = toSlug(resolvedName) || safeSkillId;\n\n      if (!id) {\n        throw new HTTPException(400, {\n          message: 'Could not derive skill ID from registry skill metadata.',\n        });\n      }\n\n      // Reject collisions instead of silently overwriting; UI offers \"Open existing\".\n      const existing = await skillStore.getById(id);\n      if (existing) {\n        throw new HTTPException(409, {\n          message: `Skill with id \"${id}\" already exists.`,\n          // Surface the existing id so the client can deep-link.\n          cause: { storedSkillId: id },\n        });\n      }\n\n      // Match the standard create flow: no caller = always public, otherwise default private.\n      const authorId = getCallerAuthorId(requestContext) ?? undefined;\n      const visibility: 'private' | 'public' = authorId ? (bodyVisibility ?? 'private') : 'public';\n\n      // Use the SKILL.md body (post-frontmatter) as instructions. Frontmatter\n      // values are already lifted into structured columns above, so re-storing\n      // them in `instructions` would both duplicate metadata and feed YAML\n      // into the agent's prompt. Fall back to description when no usable body\n      // exists so `resolved.snapshot.instructions` stays non-empty.\n      const instructions = snapshot?.instructions?.trim() ? snapshot.instructions : description;\n\n      await skillStore.create({\n        skill: {\n          id,\n          authorId,\n          visibility,\n          name: resolvedName,\n          description,\n          instructions,\n          files,\n          metadata: {\n            origin: {\n              type: 'skills-sh',\n              owner,\n              repo,\n              skillName,\n            },\n          },\n        },\n      });\n\n      return {\n        storedSkillId: id,\n        name: resolvedName,\n        filesWritten: result.files.length,\n      };\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      return handleError(error, 'Error installing registry skill');\n    }\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,6BAA6B,EAAE,OAAO;CACjD,IAAI,EAAE,QAAQ,WAAW,CAAC,CAAC,SAAS,4BAA4B;CAChE,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS,4DAA4D;CAC1F,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,8BAA8B;AAC3D,CAAC;;AAGD,MAAa,kCAAkC,EAAE,OAAO,EACtD,YAAY,EAAE,MAAM,0BAA0B,EAChD,CAAC;;AAOD,MAAa,4BAA4B,EAAE,OAAO,EAChD,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS,0CAAwC,EAC1E,CAAC;AAED,MAAa,mCAAmC,EAAE,OAAO;CACvD,GAAG,EAAE,OAAO,CAAC,CAAC,SAAS,cAAc;CACrC,OAAO,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,mCAAmC;AACpH,CAAC;AAED,MAAa,oCAAoC,EAC9C,OAAO;CACN,OAAO,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,mCAAmC;CAClH,QAAQ,EAAE,OACP,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC,CACV,SAAS,uDAAuD;AACrE,CAAC,CAAC,CACD,QAAO,SAAQ,KAAK,SAAS,KAAK,UAAU,GAAG;CAC9C,SAAS;CACT,MAAM,CAAC,QAAQ;AACjB,CAAC;AAEH,MAAa,oCAAoC,EAAE,OAAO;CACxD,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,yBAAyB;CACpD,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,wBAAwB;CAClD,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,wBAAwB;AACpD,CAAC;;;;;;;AAYD,MAAa,mCAAmC,EAAE,OAAO;CACvD,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,yBAAyB;CACpD,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,wBAAwB;CAClD,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS,8BAA8B;CAC7D,YAAY,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,qCAAqC;AACrG,CAAC;;AAGD,MAAa,uCAAuC,EAAE,OAAO;CAC3D,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS,sCAAsC;CACzE,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,qBAAqB;CAC/C,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS,8DAA8D;AAClG,CAAC;;;;AC3CD,MAAM,kBAA0C,EAC9C,aAAa,YACf;;;;;;;AAcA,eAAe,kBAAkB,QAA2C;CAC1E,MAAM,SAAS,OAAO,UAAU;CAChC,IAAI,CAAC,UAAU,OAAO,OAAO,mBAAmB,YAC9C,OAAO,CAAC;EAAE,IAAI;EAAa,SAAS;EAAO,OAAO,gBAAgB;CAAc,CAAC;CAInF,OAAO,CACL;EACE,IAAI;EACJ,WAJe,MADG,OAAO,eAAe,EAAA,EAChB,gBAAgB,EAAA,EAInB,UAAU,YAAY;EAC3C,OAAO,gBAAgB;CACzB,CACF;AACF;;;;;AAMA,eAAe,uBAAuB,QAAgB,YAAmC;CAEvF,MAAM,SAAQ,MADK,kBAAkB,MAAM,EAAA,CACxB,MAAK,MAAK,EAAE,OAAO,UAAU;CAChD,IAAI,CAAC,SAAS,CAAC,MAAM,SACnB,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,qBAAqB,CAAC;AAElE;;;;;;;;AAaA,SAAS,cACP,OACwB;CACxB,MAAM,OAA+B,CAAC;CAEtC,KAAK,MAAM,QAAQ,OAAO;EAExB,MAAM,WADW,mBAAmB,KAAK,IACjB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;EACnD,IAAI,SAAS,WAAW,GAAG;EAE3B,IAAI,SAAS;EACb,KAAK,IAAI,IAAI,GAAG,IAAI,SAAS,SAAS,GAAG,KAAK;GAC5C,MAAM,UAAU,SAAS;GACzB,IAAI,SAAS,OAAO,MAAK,SAAQ,KAAK,SAAS,YAAY,KAAK,SAAS,OAAO;GAChF,IAAI,CAAC,QAAQ;IACX,SAAS;KAAE,MAAM;KAAS,MAAM;KAAU,UAAU,CAAC;IAAE;IACvD,OAAO,KAAK,MAAM;GACpB;GACA,IAAI,CAAC,OAAO,UAAU,OAAO,WAAW,CAAC;GACzC,SAAS,OAAO;EAClB;EAEA,MAAM,WAAW,SAAS,SAAS,SAAS;EAC5C,MAAM,UAAU,KAAK,aAAa,WAAW,OAAO,KAAK,KAAK,SAAS,QAAQ,CAAC,CAAC,SAAS,OAAO,IAAI,KAAK;EAC1G,OAAO,KAAK;GAAE,MAAM;GAAU,MAAM;GAAQ;EAAQ,CAAC;CACvD;CAEA,OAAO;AACT;AAqBA,SAAS,mBACP,OAC4B;CAC5B,MAAM,UAAU,MAAM,MAAK,MAAK,EAAE,SAAS,UAAU;CACrD,IAAI,CAAC,SAAS,OAAO;CAErB,MAAM,MACJ,QAAQ,aAAa,WAAW,OAAO,KAAK,QAAQ,SAAS,QAAQ,CAAC,CAAC,SAAS,OAAO,IAAI,QAAQ;CAErG,MAAM,UAAU,IAAI,MAAM,6CAA6C;CACvE,IAAI,CAAC,SACH,OAAO,EAAE,cAAc,IAAI,KAAK,EAAE;CAGpC,MAAM,UAAU,QAAQ,MAAM;CAC9B,MAAM,OAAO,QAAQ,MAAM;CAC3B,MAAM,cAAsC,CAAC;CAC7C,KAAK,MAAM,QAAQ,QAAQ,MAAM,OAAO,GAAG;EACzC,MAAM,IAAI,KAAK,MAAM,+BAA+B;EACpD,IAAI,CAAC,GAAG;EACR,MAAM,MAAM,EAAE;EACd,MAAM,QAAQ,EAAE,MAAM;EACtB,IAAI,CAAC,KAAK;EAGV,YAAY,OAAO,MAAM,KAAK,CAAC,CAAC,QAAQ,kBAAkB,IAAI;CAChE;CAEA,OAAO;EACL,MAAM,YAAY;EAClB,aAAa,YAAY;EACzB,cAAc,KAAK,KAAK;CAC1B;AACF;;;;;;;;AAaA,MAAa,gCAAgC,YAAY;CACvD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,QAAQ;CACf,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,aAAa;EAC7B,IAAI;GAEF,OAAO,EAAE,YAAA,MADgB,kBAAkB,MAAM,EAC7B;EACtB,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,kCAAkC;EAC9D;CACF;AACF,CAAC;;;;;;;AAQD,MAAa,gCAAgC,YAAY;CACvD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,QAAQ;CACzB,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,YAAY,GAAG,YAAY;EACnD,IAAI;GACF,MAAM,uBAAuB,QAAQ,UAAU;GAC/C,OAAO,MAAM,eAAe;IAAE;IAAG;GAAM,CAAC;EAC1C,SAAS,OAAO;GACd,IAAI,iBAAiB,eAAe,MAAM;GAC1C,OAAO,YAAY,OAAO,0BAA0B;EACtD;CACF;AACF,CAAC;;;;;;AAOD,MAAa,iCAAiC,YAAY;CACxD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,QAAQ;CACzB,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,YAAY,OAAO,aAAa;EACxD,IAAI;GACF,MAAM,uBAAuB,QAAQ,UAAU;GAC/C,OAAO,MAAM,mBAAmB;IAAE;IAAO;GAAO,CAAC;EACnD,SAAS,OAAO;GACd,IAAI,iBAAiB,eAAe,MAAM;GAC1C,OAAO,YAAY,OAAO,+BAA+B;EAC3D;CACF;AACF,CAAC;;;;;;AAOD,MAAa,iCAAiC,YAAY;CACxD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,QAAQ;CACzB,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,YAAY,OAAO,MAAM,MAAM,gBAAgB;EACvE,IAAI;GACF,MAAM,uBAAuB,QAAQ,UAAU;GAC/C,OAAO,MAAM,gBAAgB;IAAE;IAAO;IAAM;GAAU,CAAC;EACzD,SAAS,OAAO;GACd,IAAI,iBAAiB,eAAe,MAAM;GAC1C,OAAO,YAAY,OAAO,8BAA8B;EAC1D;CACF;AACF,CAAC;;;;;;;;;;;;;;AAeD,MAAa,iCAAiC,YAAY;CACxD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,YAAY;CACZ,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,QAAQ;CACzB,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,gBAAgB,YAAY,OAAO,MAAM,WAAW,YAAY,qBAAqB;EAC7G,IAAI;GACF,MAAM,uBAAuB,QAAQ,UAAU;GAE/C,MAAM,UAAU,OAAO,WAAW;GAClC,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,4BAA4B,CAAC;GAEvE,MAAM,aAAa,MAAM,QAAQ,SAAS,QAAQ;GAClD,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,yCAAyC,CAAC;GAIpF,MAAM,SAAS,MAAM,gBAAgB,OAAO,MAAM,SAAS;GAC3D,IAAI,CAAC,UAAU,OAAO,MAAM,WAAW,GACrC,MAAM,IAAI,cAAc,KAAK,EAC3B,SAAS,yBAAyB,UAAU,OAAO,MAAM,GAAG,KAAK,GACnE,CAAC;GAGH,MAAM,cAAc,oBAAoB,OAAO,OAAO;GACtD,MAAM,QAAQ,cAAc,OAAO,KAAK;GAOxC,MAAM,WAAW,mBAAmB,OAAO,KAAK;GAEhD,MAAM,eAAe,UAAU,QAAQ;GACvC,MAAM,cAAc,UAAU,eAAe,iBAAiB,MAAM,GAAG;GACvE,MAAM,KAAK,OAAO,YAAY,KAAK;GAEnC,IAAI,CAAC,IACH,MAAM,IAAI,cAAc,KAAK,EAC3B,SAAS,0DACX,CAAC;GAKH,IAAI,MADmB,WAAW,QAAQ,EAAE,GAE1C,MAAM,IAAI,cAAc,KAAK;IAC3B,SAAS,kBAAkB,GAAG;IAE9B,OAAO,EAAE,eAAe,GAAG;GAC7B,CAAC;GAIH,MAAM,WAAW,kBAAkB,cAAc,KAAK,KAAA;GACtD,MAAM,aAAmC,WAAY,kBAAkB,YAAa;GAOpF,MAAM,eAAe,UAAU,cAAc,KAAK,IAAI,SAAS,eAAe;GAE9E,MAAM,WAAW,OAAO,EACtB,OAAO;IACL;IACA;IACA;IACA,MAAM;IACN;IACA;IACA;IACA,UAAU,EACR,QAAQ;KACN,MAAM;KACN;KACA;KACA;IACF,EACF;GACF,EACF,CAAC;GAED,OAAO;IACL,eAAe;IACf,MAAM;IACN,cAAc,OAAO,MAAM;GAC7B;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,eAAe,MAAM;GAC1C,OAAO,YAAY,OAAO,iCAAiC;EAC7D;CACF;AACF,CAAC"}

package/dist/{dist-DhFw0bEW.cjs → dist-COHIL6fR.cjs}

@@ -5962,15 +5962,15 @@ function splitLines(text) {
 	return result;
 }
 //#endregion
-//#region ../memory/dist/src-DvQWV6nH.js
-var __defProp$4 = Object.defineProperty;
+//#region ../memory/dist/src-Cwt9gefz.js
+var __defProp$3 = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
 	let target = {};
-	for (var name in all) __defProp$4(target, name, {
+	for (var name in all) __defProp$3(target, name, {
 		get: all[name],
 		enumerable: true
 	});
-	if (!no_symbols) __defProp$4(target, Symbol.toStringTag, { value: "Module" });
+	if (!no_symbols) __defProp$3(target, Symbol.toStringTag, { value: "Module" });
 	return target;
 };
 var marker$6 = "vercel.ai.error";
@@ -6114,7 +6114,7 @@ Error message: ${getErrorMessage$4(cause)}`,
 _a13$5 = symbol13$5;
 var TypeValidationError$2 = _TypeValidationError;
 var __create = Object.create;
-var __defProp$3 = Object.defineProperty;
+var __defProp$1$1 = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
@@ -6123,14 +6123,14 @@ var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).expor
 var __copyProps = (to, from, except, desc) => {
 	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
 		key = keys[i];
-		if (!__hasOwnProp.call(to, key) && key !== except) __defProp$3(to, key, {
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp$1$1(to, key, {
 			get: ((k) => from[k]).bind(null, key),
 			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
 		});
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp$3(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp$1$1(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));
@@ -10193,6 +10193,12 @@ async function cancelResponseBody$1(response) {
 		await ((_a2 = response.body) == null ? void 0 : _a2.cancel());
 	} catch (e) {}
 }
+var initialGlobalFetch$1 = globalThis.fetch;
+isNodeDefaultFetch$1(initialGlobalFetch$1);
+function isNodeDefaultFetch$1(fetch) {
+	const source = Function.prototype.toString.call(fetch);
+	return source.includes("internal/deps/undici") || source.includes("lazy loading of undici");
+}
 var DEFAULT_MAX_DOWNLOAD_SIZE$1 = 2 * 1024 * 1024 * 1024;
 async function readResponseWithSizeLimit$1({ response, url, maxBytes = DEFAULT_MAX_DOWNLOAD_SIZE$1 }) {
 	const contentLength = response.headers.get("content-length");
@@ -10302,11 +10308,11 @@ function withUserAgentSuffix$1(headers, ...userAgentSuffixParts) {
 	normalizedHeaders.set("user-agent", [currentUserAgentHeader, ...userAgentSuffixParts].filter(Boolean).join(" "));
 	return Object.fromEntries(normalizedHeaders.entries());
 }
-var VERSION$4 = "3.0.30";
+var VERSION$4 = "3.0.31";
 var getOriginalFetch$1 = () => globalThis.fetch;
-var getFromApi$1 = async ({ url, headers = {}, successfulResponseHandler, failedResponseHandler, abortSignal, fetch: fetch2 = getOriginalFetch$1() }) => {
+var getFromApi$1 = async ({ url, headers = {}, successfulResponseHandler, failedResponseHandler, abortSignal, fetch = getOriginalFetch$1() }) => {
 	try {
-		const response = await fetch2(url, {
+		const response = await fetch(url, {
 			method: "GET",
 			headers: withUserAgentSuffix$1(headers, `ai-sdk/provider-utils/${VERSION$4}`, getRuntimeEnvironmentUserAgent$1()),
 			signal: abortSignal
@@ -10532,7 +10538,7 @@ function parseJsonEventStream$1({ stream, schema }) {
 	} }));
 }
 var getOriginalFetch2$1 = () => globalThis.fetch;
-var postJsonToApi$1 = async ({ url, headers, body, failedResponseHandler, successfulResponseHandler, abortSignal, fetch: fetch2 }) => postToApi$1({
+var postJsonToApi$1 = async ({ url, headers, body, failedResponseHandler, successfulResponseHandler, abortSignal, fetch }) => postToApi$1({
 	url,
 	headers: {
 		"Content-Type": "application/json",
@@ -10545,11 +10551,11 @@ var postJsonToApi$1 = async ({ url, headers, body, failedResponseHandler, succes
 	failedResponseHandler,
 	successfulResponseHandler,
 	abortSignal,
-	fetch: fetch2
+	fetch
 });
-var postToApi$1 = async ({ url, headers = {}, body, successfulResponseHandler, failedResponseHandler, abortSignal, fetch: fetch2 = getOriginalFetch2$1() }) => {
+var postToApi$1 = async ({ url, headers = {}, body, successfulResponseHandler, failedResponseHandler, abortSignal, fetch = getOriginalFetch2$1() }) => {
 	try {
-		const response = await fetch2(url, {
+		const response = await fetch(url, {
 			method: "POST",
 			headers: withUserAgentSuffix$1(headers, `ai-sdk/provider-utils/${VERSION$4}`, getRuntimeEnvironmentUserAgent$1()),
 			body: body.content,
@@ -12609,7 +12615,7 @@ async function getVercelRequestId$1() {
 	var _a10;
 	return (_a10 = getContext$1().headers) == null ? void 0 : _a10["x-vercel-id"];
 }
-var VERSION$2$2 = "2.0.115";
+var VERSION$2$2 = "2.0.125";
 var AI_GATEWAY_PROTOCOL_VERSION$1 = "0.0.1";
 function createGatewayProvider$1(options = {}) {
 	var _a10, _b10;
@@ -13643,7 +13649,7 @@ function getGlobalProvider$1() {
 	var _a16;
 	return (_a16 = globalThis.AI_SDK_DEFAULT_PROVIDER) != null ? _a16 : gateway$1;
 }
-var VERSION$5 = "5.0.216";
+var VERSION$5 = "5.0.226";
 var dataContentSchema$1 = zod_v4.z.union([
 	zod_v4.z.string(),
 	zod_v4.z.instanceof(Uint8Array),
@@ -15078,6 +15084,12 @@ var DownloadError$2 = class extends (_b$2$1 = AISDKError$3, _a$2$1 = symbol$2$1,
 		return AISDKError$3.hasMarker(error, marker$2$1);
 	}
 };
+var initialGlobalFetch$2 = globalThis.fetch;
+isNodeDefaultFetch$2(initialGlobalFetch$2);
+function isNodeDefaultFetch$2(fetch) {
+	const source = Function.prototype.toString.call(fetch);
+	return source.includes("internal/deps/undici") || source.includes("lazy loading of undici");
+}
 var DEFAULT_MAX_DOWNLOAD_SIZE$2 = 2 * 1024 * 1024 * 1024;
 async function readResponseWithSizeLimit$2({ response, url, maxBytes = DEFAULT_MAX_DOWNLOAD_SIZE$2 }) {
 	const contentLength = response.headers.get("content-length");
@@ -15209,11 +15221,11 @@ function withUserAgentSuffix$2(headers, ...userAgentSuffixParts) {
 	normalizedHeaders.set("user-agent", [currentUserAgentHeader, ...userAgentSuffixParts].filter(Boolean).join(" "));
 	return Object.fromEntries(normalizedHeaders.entries());
 }
-var VERSION$3$1 = "4.0.40";
+var VERSION$3$1 = "4.0.41";
 var getOriginalFetch$2 = () => globalThis.fetch;
-var getFromApi$2 = async ({ url, headers = {}, successfulResponseHandler, failedResponseHandler, abortSignal, fetch: fetch2 = getOriginalFetch$2() }) => {
+var getFromApi$2 = async ({ url, headers = {}, successfulResponseHandler, failedResponseHandler, abortSignal, fetch = getOriginalFetch$2() }) => {
 	try {
-		const response = await fetch2(url, {
+		const response = await fetch(url, {
 			method: "GET",
 			headers: withUserAgentSuffix$2(headers, `ai-sdk/provider-utils/${VERSION$3$1}`, getRuntimeEnvironmentUserAgent$2()),
 			signal: abortSignal
@@ -16400,7 +16412,7 @@ function parseJsonEventStream$2({ stream, schema }) {
 	} }));
 }
 var getOriginalFetch2$2 = () => globalThis.fetch;
-var postJsonToApi$2 = async ({ url, headers, body, failedResponseHandler, successfulResponseHandler, abortSignal, fetch: fetch2 }) => postToApi$2({
+var postJsonToApi$2 = async ({ url, headers, body, failedResponseHandler, successfulResponseHandler, abortSignal, fetch }) => postToApi$2({
 	url,
 	headers: {
 		"Content-Type": "application/json",
@@ -16413,11 +16425,11 @@ var postJsonToApi$2 = async ({ url, headers, body, failedResponseHandler, succes
 	failedResponseHandler,
 	successfulResponseHandler,
 	abortSignal,
-	fetch: fetch2
+	fetch
 });
-var postToApi$2 = async ({ url, headers = {}, body, successfulResponseHandler, failedResponseHandler, abortSignal, fetch: fetch2 = getOriginalFetch2$2() }) => {
+var postToApi$2 = async ({ url, headers = {}, body, successfulResponseHandler, failedResponseHandler, abortSignal, fetch = getOriginalFetch2$2() }) => {
 	try {
-		const response = await fetch2(url, {
+		const response = await fetch(url, {
 			method: "POST",
 			headers: withUserAgentSuffix$2(headers, `ai-sdk/provider-utils/${VERSION$3$1}`, getRuntimeEnvironmentUserAgent$2()),
 			body: body.content,
@@ -18196,7 +18208,7 @@ async function getVercelRequestId$2() {
 	var _a11;
 	return (_a11 = getContext$2().headers) == null ? void 0 : _a11["x-vercel-id"];
 }
-var VERSION$2$1 = "3.0.153";
+var VERSION$2$1 = "3.0.163";
 var AI_GATEWAY_PROTOCOL_VERSION$2 = "0.0.1";
 function createGatewayProvider$2(options = {}) {
 	var _a11, _b11;
@@ -19192,9 +19204,9 @@ const trace = class TraceAPI {
 		this._proxyTracerProvider = new ProxyTracerProvider$3();
 	}
 }.getInstance();
-var __defProp$5 = Object.defineProperty;
+var __defProp$4 = Object.defineProperty;
 var __export$3 = (target, all) => {
-	for (var name22 in all) __defProp$5(target, name22, {
+	for (var name22 in all) __defProp$4(target, name22, {
 		get: all[name22],
 		enumerable: true
 	});
@@ -19353,7 +19365,7 @@ function getTotalTimeoutMs(timeout) {
 	if (typeof timeout === "number") return timeout;
 	return timeout.totalMs;
 }
-var VERSION = "6.0.230";
+var VERSION = "6.0.241";
 var dataContentSchema$3 = zod_v4.z.union([
 	zod_v4.z.string(),
 	zod_v4.z.instanceof(Uint8Array),
@@ -26303,6 +26315,68 @@ function isMessageAtOrBeforeCursor(msg, cursor) {
 	return false;
 }
 /**
+* Return the toolCallId of a tool-invocation part in the given state, or undefined.
+*/
+function getToolInvocationId(part, state) {
+	if (part?.type !== "tool-invocation") return void 0;
+	if (part.toolInvocation.state !== state) return void 0;
+	return part.toolInvocation.toolCallId || void 0;
+}
+function collectPendingToolResultIds(allMessages, observedIds) {
+	const pendingToolResultIds = /* @__PURE__ */ new Set();
+	for (const msg of allMessages) {
+		if (!msg?.id) continue;
+		if (observedIds?.has(msg.id)) continue;
+		const parts = msg.content?.parts;
+		if (!parts || !Array.isArray(parts)) continue;
+		for (const part of parts) {
+			const id = getToolInvocationId(part, "result");
+			if (id) pendingToolResultIds.add(id);
+		}
+	}
+	return pendingToolResultIds;
+}
+function hasPendingToolResultPair(message, pendingToolResultIds) {
+	if (pendingToolResultIds.size === 0) return false;
+	const parts = message.content?.parts;
+	if (!parts || !Array.isArray(parts)) return false;
+	return parts.some((part) => {
+		const id = getToolInvocationId(part, "call");
+		return id !== void 0 && pendingToolResultIds.has(id);
+	});
+}
+function collectPendingToolResultIdsAfterMarker(allMessages, markerMessageIndex, markerMessage) {
+	const pendingToolResultIds = /* @__PURE__ */ new Set();
+	const unobservedMarkerParts = getUnobservedParts(markerMessage);
+	if (unobservedMarkerParts.length > 0) collectPendingToolResultIds([{
+		...markerMessage,
+		content: {
+			...markerMessage.content,
+			parts: unobservedMarkerParts
+		}
+	}], void 0).forEach((id) => pendingToolResultIds.add(id));
+	collectPendingToolResultIds(allMessages.slice(markerMessageIndex + 1), void 0).forEach((id) => pendingToolResultIds.add(id));
+	return pendingToolResultIds;
+}
+function getUnobservedPartsPreservingToolCallPairs(message) {
+	const parts = message.content?.parts;
+	if (!parts || !Array.isArray(parts)) return [];
+	const endMarkerIndex = findLastCompletedObservationBoundary(message);
+	if (endMarkerIndex === -1) return getUnobservedParts(message);
+	const unobservedParts = getUnobservedParts(message);
+	const unobservedResultIds = /* @__PURE__ */ new Set();
+	for (const part of unobservedParts) {
+		const id = getToolInvocationId(part, "result");
+		if (id) unobservedResultIds.add(id);
+	}
+	if (unobservedResultIds.size === 0) return unobservedParts;
+	const preservedCalls = parts.slice(0, endMarkerIndex).filter((part) => {
+		const id = getToolInvocationId(part, "call");
+		return id !== void 0 && unobservedResultIds.has(id);
+	});
+	return preservedCalls.length > 0 ? [...preservedCalls, ...unobservedParts] : unobservedParts;
+}
+/**
 * Safely extract buffered observation chunks from a record.
 * Handles both array and JSON-string formats, returning empty array if malformed.
 */
@@ -26318,6 +26392,7 @@ function filterObservedMessages(opts) {
 	const allMessages = messageList.get.all.db();
 	const useMarkerBoundaryPruning = opts.useMarkerBoundaryPruning ?? true;
 	const preserveMessageIds = opts.preserveMessageIds ?? /* @__PURE__ */ new Set();
+	const observedIds = new Set(Array.isArray(record?.observedMessageIds) ? record.observedMessageIds : []);
 	let markerMessageIndex = -1;
 	let markerMessage = null;
 	for (let i = allMessages.length - 1; i >= 0; i--) {
@@ -26330,33 +26405,40 @@ function filterObservedMessages(opts) {
 		}
 	}
 	if (useMarkerBoundaryPruning && markerMessage && markerMessageIndex !== -1) {
+		const pendingToolResultIds = collectPendingToolResultIdsAfterMarker(allMessages, markerMessageIndex, markerMessage);
 		const messagesToRemove = [];
 		for (let i = 0; i < markerMessageIndex; i++) {
 			const msg = allMessages[i];
-			if (msg?.id && msg.id !== "om-continuation" && !preserveMessageIds.has(msg.id)) messagesToRemove.push(msg.id);
+			if (msg?.id && msg.id !== "om-continuation" && !preserveMessageIds.has(msg.id) && !hasPendingToolResultPair(msg, pendingToolResultIds)) messagesToRemove.push(msg.id);
 		}
 		if (messagesToRemove.length > 0) messageList.removeByIds(messagesToRemove);
-		const unobserved = getUnobservedParts(markerMessage);
+		const unobserved = getUnobservedPartsPreservingToolCallPairs(markerMessage);
 		if (unobserved.length === 0) {
 			if (markerMessage.id) messageList.removeByIds([markerMessage.id]);
 		} else if (unobserved.length < (markerMessage.content?.parts?.length ?? 0)) markerMessage.content.parts = unobserved;
 	} else if (record) {
-		const observedIds = new Set(Array.isArray(record.observedMessageIds) ? record.observedMessageIds : []);
+		const pendingToolResultIds = collectPendingToolResultIds(allMessages, observedIds);
 		const derivedCursor = opts.fallbackCursor ?? getLastObservedMessageCursor(allMessages.filter((msg) => !!msg?.id && observedIds.has(msg.id) && !!msg.createdAt));
 		const lastObservedAt = record.lastObservedAt;
 		const messagesToRemove = [];
 		for (const msg of allMessages) {
 			if (!msg?.id || msg.id === "om-continuation" || preserveMessageIds.has(msg.id)) continue;
+			const hasPendingPair = hasPendingToolResultPair(msg, pendingToolResultIds);
 			if (observedIds.has(msg.id)) {
+				if (hasPendingPair) continue;
 				messagesToRemove.push(msg.id);
 				continue;
 			}
 			if (derivedCursor && isMessageAtOrBeforeCursor(msg, derivedCursor)) {
+				if (hasPendingPair) continue;
 				messagesToRemove.push(msg.id);
 				continue;
 			}
 			if (lastObservedAt && msg.createdAt) {
-				if (new Date(msg.createdAt) <= lastObservedAt) messagesToRemove.push(msg.id);
+				if (new Date(msg.createdAt) <= lastObservedAt) {
+					if (hasPendingPair) continue;
+					messagesToRemove.push(msg.id);
+				}
 			}
 		}
 		if (messagesToRemove.length > 0) messageList.removeByIds(messagesToRemove);
@@ -29634,6 +29716,14 @@ var ObservationalMemory = class ObservationalMemory {
 	*/
 	locks = /* @__PURE__ */ new Map();
 	/**
+	* Initial record lookup/creation promises keyed by the effective storage scope.
+	* Concurrent callers share the full read-or-create operation so a stale read
+	* cannot create another generation-zero record after the first insert finishes.
+	* Entries are removed after both success and failure so later calls always
+	* re-read storage and transient failures can be retried.
+	*/
+	recordInitializations = /* @__PURE__ */ new Map();
+	/**
 	* Acquire a lock for the given key, execute the callback, then release.
 	* If a lock is already held, waits for it to be released before acquiring.
 	*/
@@ -29994,10 +30084,14 @@ var ObservationalMemory = class ObservationalMemory {
 	*/
 	async getOrCreateRecord(threadId, resourceId) {
 		const ids = this.getStorageIds(threadId, resourceId);
-		let record = await this.storage.getObservationalMemory(ids.threadId, ids.resourceId);
-		if (!record) {
+		const initializationKey = ids.threadId === null ? `resource:${ids.resourceId}` : `thread:${ids.threadId}`;
+		const pendingInitialization = this.recordInitializations.get(initializationKey);
+		if (pendingInitialization) return pendingInitialization;
+		const initialization = Promise.resolve().then(async () => {
+			const record = await this.storage.getObservationalMemory(ids.threadId, ids.resourceId);
+			if (record) return record;
 			const observedTimezone = Intl.DateTimeFormat().resolvedOptions().timeZone;
-			record = await this.storage.initializeObservationalMemory({
+			return this.storage.initializeObservationalMemory({
 				threadId: ids.threadId,
 				resourceId: ids.resourceId,
 				scope: this.scope,
@@ -30008,8 +30102,13 @@ var ObservationalMemory = class ObservationalMemory {
 				},
 				observedTimezone
 			});
+		});
+		this.recordInitializations.set(initializationKey, initialization);
+		try {
+			return await initialization;
+		} finally {
+			if (this.recordInitializations.get(initializationKey) === initialization) this.recordInitializations.delete(initializationKey);
 		}
-		return record;
 	}
 	/**
 	* Get current config snapshot for observation markers.
@@ -32350,6 +32449,11 @@ function filterSystemReminderMessages(messages, includeSystemReminders) {
 	if (includeSystemReminders) return messages;
 	return messages.filter((message) => !isSystemReminderMessage(message));
 }
+function isTransientSignalMessage(message) {
+	if (message.role !== "signal" || !isRecord(message.content)) return false;
+	const metadata = message.content.metadata;
+	return isRecord(metadata) && isRecord(metadata.signal) && !Array.isArray(metadata.signal) && metadata.signal.transient === true;
+}
 function normalizeObservationalMemoryConfig(config) {
 	if (config === true) return { model: "google/gemini-2.5-flash" };
 	if (config === false || config === void 0) return void 0;
@@ -32883,7 +32987,7 @@ ${workingMemory}`;
 	async saveMessages({ messages, memoryConfig, observabilityContext }) {
 		const span = this.createMemorySpan("save", observabilityContext, void 0, { messageCount: messages.length });
 		try {
-			const updatedMessages = messages.filter((m) => m.role !== "system").map((m) => {
+			const updatedMessages = messages.filter((m) => m.role !== "system" && !isTransientSignalMessage(m)).map((m) => {
 				return this.updateMessageToHideWorkingMemoryV2(m);
 			}).filter((m) => Boolean(m));
 			const config = this.getMergedThreadConfig(memoryConfig);
@@ -33175,7 +33279,7 @@ ${workingMemory}`;
 	*/
 	async persistMessages(messages) {
 		if (messages.length === 0) return;
-		const persistableMessages = messages.filter((m) => m.role !== "system");
+		const persistableMessages = messages.filter((m) => m.role !== "system" && !isTransientSignalMessage(m));
 		if (persistableMessages.length === 0) return;
 		await (await this.getMemoryStore()).saveMessages({ messages: persistableMessages });
 	}
@@ -39375,6 +39479,12 @@ async function cancelResponseBody(response) {
 		await ((_a2 = response.body) == null ? void 0 : _a2.cancel());
 	} catch (e) {}
 }
+var initialGlobalFetch = globalThis.fetch;
+isNodeDefaultFetch(initialGlobalFetch);
+function isNodeDefaultFetch(fetch) {
+	const source = Function.prototype.toString.call(fetch);
+	return source.includes("internal/deps/undici") || source.includes("lazy loading of undici");
+}
 var DEFAULT_MAX_DOWNLOAD_SIZE = 2 * 1024 * 1024 * 1024;
 async function readResponseWithSizeLimit({ response, url, maxBytes = DEFAULT_MAX_DOWNLOAD_SIZE }) {
 	const contentLength = response.headers.get("content-length");
@@ -39478,11 +39588,11 @@ function withUserAgentSuffix(headers, ...userAgentSuffixParts) {
 	normalizedHeaders.set("user-agent", [currentUserAgentHeader, ...userAgentSuffixParts].filter(Boolean).join(" "));
 	return Object.fromEntries(normalizedHeaders.entries());
 }
-var VERSION$3 = "3.0.30";
+var VERSION$3 = "3.0.31";
 var getOriginalFetch = () => globalThis.fetch;
-var getFromApi = async ({ url, headers = {}, successfulResponseHandler, failedResponseHandler, abortSignal, fetch: fetch2 = getOriginalFetch() }) => {
+var getFromApi = async ({ url, headers = {}, successfulResponseHandler, failedResponseHandler, abortSignal, fetch = getOriginalFetch() }) => {
 	try {
-		const response = await fetch2(url, {
+		const response = await fetch(url, {
 			method: "GET",
 			headers: withUserAgentSuffix(headers, `ai-sdk/provider-utils/${VERSION$3}`, getRuntimeEnvironmentUserAgent()),
 			signal: abortSignal
@@ -39708,7 +39818,7 @@ function parseJsonEventStream({ stream, schema }) {
 	} }));
 }
 var getOriginalFetch2 = () => globalThis.fetch;
-var postJsonToApi = async ({ url, headers, body, failedResponseHandler, successfulResponseHandler, abortSignal, fetch: fetch2 }) => postToApi({
+var postJsonToApi = async ({ url, headers, body, failedResponseHandler, successfulResponseHandler, abortSignal, fetch }) => postToApi({
 	url,
 	headers: {
 		"Content-Type": "application/json",
@@ -39721,11 +39831,11 @@ var postJsonToApi = async ({ url, headers, body, failedResponseHandler, successf
 	failedResponseHandler,
 	successfulResponseHandler,
 	abortSignal,
-	fetch: fetch2
+	fetch
 });
-var postToApi = async ({ url, headers = {}, body, successfulResponseHandler, failedResponseHandler, abortSignal, fetch: fetch2 = getOriginalFetch2() }) => {
+var postToApi = async ({ url, headers = {}, body, successfulResponseHandler, failedResponseHandler, abortSignal, fetch = getOriginalFetch2() }) => {
 	try {
-		const response = await fetch2(url, {
+		const response = await fetch(url, {
 			method: "POST",
 			headers: withUserAgentSuffix(headers, `ai-sdk/provider-utils/${VERSION$3}`, getRuntimeEnvironmentUserAgent()),
 			body: body.content,
@@ -41785,7 +41895,7 @@ async function getVercelRequestId() {
 	var _a10;
 	return (_a10 = getContext().headers) == null ? void 0 : _a10["x-vercel-id"];
 }
-var VERSION$2 = "2.0.115";
+var VERSION$2 = "2.0.125";
 var AI_GATEWAY_PROTOCOL_VERSION = "0.0.1";
 function createGatewayProvider(options = {}) {
 	var _a10, _b10;
@@ -44498,4 +44608,4 @@ const agentBuilderWorkflows = {
 //#endregion
 exports.agentBuilderWorkflows = agentBuilderWorkflows;
 
-//# sourceMappingURL=dist-DhFw0bEW.cjs.map
+//# sourceMappingURL=dist-COHIL6fR.cjs.map