@mastra/server 1.75.0-alpha.0 → 1.75.0-alpha.1

package/dist/server/handlers/conversations.cjs

@@ -3,7 +3,7 @@ const require_rolldown_runtime = require("../../rolldown-runtime-Bd6kNlEP.cjs");
 const require_http_exception = require("../../http-exception-CKDHupKw.cjs");
 const require_route_builder = require("../../route-builder-2yrD15TL.cjs");
 const require_server_handlers_error = require("./error.cjs");
-const require_utils = require("../../utils-aIu3gkhJ.cjs");
+const require_utils = require("../../utils-HqDZJwRc.cjs");
 const require_server_handlers_agents = require("./agents.cjs");
 const require_conversations = require("../../conversations-DX7ATgEB.cjs");
 const require_server_handlers_responses_adapter = require("./responses.adapter.cjs");

package/dist/server/handlers/conversations.js

@@ -2,7 +2,7 @@ import { r as __exportAll } from "../../rolldown-runtime-maW3aOIk.js";
 import { t as HTTPException } from "../../http-exception-CyfxZB6W.js";
 import { n as createRoute } from "../../route-builder-lBil8Cvo.js";
 import { handleError } from "./error.js";
-import { p as MastraFGAPermissions, r as getEffectiveResourceId } from "../../utils-KsERfbhc.js";
+import { m as MastraFGAPermissions, r as getEffectiveResourceId } from "../../utils-KcHk7C0D.js";
 import { getAgentFromSystem } from "./agents.js";
 import { a as createConversationBodySchema, i as conversationObjectSchema, n as conversationIdPathParams, r as conversationItemsListSchema, t as conversationDeletedSchema } from "../../conversations-U3fod5tw.js";
 import { mapMastraMessagesToConversationItems } from "./responses.adapter.js";

package/dist/server/handlers/logs.cjs

@@ -3,7 +3,7 @@ const require_rolldown_runtime = require("../../rolldown-runtime-Bd6kNlEP.cjs");
 const require_common = require("../../common-BkgcoK-2.cjs");
 const require_route_builder = require("../../route-builder-2yrD15TL.cjs");
 const require_server_handlers_error = require("./error.cjs");
-const require_utils = require("../../utils-aIu3gkhJ.cjs");
+const require_utils = require("../../utils-HqDZJwRc.cjs");
 const require_logs = require("../../logs-B0037Tlj.cjs");
 //#region src/server/handlers/logs.ts
 var logs_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({

package/dist/server/handlers/logs.js

@@ -2,7 +2,7 @@ import { r as __exportAll } from "../../rolldown-runtime-maW3aOIk.js";
 import { u as runIdSchema } from "../../common-tSamNYpt.js";
 import { n as createRoute } from "../../route-builder-lBil8Cvo.js";
 import { handleError } from "./error.js";
-import { o as parseFilters, u as validateBody } from "../../utils-KsERfbhc.js";
+import { d as validateBody, o as parseFilters } from "../../utils-KcHk7C0D.js";
 import { n as listLogsQuerySchema, r as listLogsResponseSchema, t as listLogTransportsResponseSchema } from "../../logs-B2Nd15Oe.js";
 //#region src/server/handlers/logs.ts
 var logs_exports = /* @__PURE__ */ __exportAll({

package/dist/server/handlers/memory.cjs

@@ -3,7 +3,7 @@ const require_rolldown_runtime = require("../../rolldown-runtime-Bd6kNlEP.cjs");
 const require_http_exception = require("../../http-exception-CKDHupKw.cjs");
 const require_route_builder = require("../../route-builder-2yrD15TL.cjs");
 const require_server_handlers_error = require("./error.cjs");
-const require_utils = require("../../utils-aIu3gkhJ.cjs");
+const require_utils = require("../../utils-HqDZJwRc.cjs");
 const require_memory = require("../../memory-C3j3i6iS.cjs");
 const require_server_handlers_gateway_memory_client = require("./gateway-memory-client.cjs");
 let _mastra_core_agent = require("@mastra/core/agent");

package/dist/server/handlers/memory.js

@@ -2,7 +2,7 @@ import { r as __exportAll } from "../../rolldown-runtime-maW3aOIk.js";
 import { t as HTTPException } from "../../http-exception-CyfxZB6W.js";
 import { n as createRoute } from "../../route-builder-lBil8Cvo.js";
 import { handleError } from "./error.js";
-import { i as getEffectiveThreadId, n as getContextResourceId, p as MastraFGAPermissions, r as getEffectiveResourceId, t as enforceThreadAccess, u as validateBody } from "../../utils-KsERfbhc.js";
+import { d as validateBody, i as getEffectiveThreadId, m as MastraFGAPermissions, n as getContextResourceId, r as getEffectiveResourceId, t as enforceThreadAccess } from "../../utils-KcHk7C0D.js";
 import { A as listThreadsNetworkQuerySchema, B as searchMemoryQuerySchema, C as getThreadByIdResponseSchema, D as listMessagesNetworkQuerySchema, G as updateThreadBodySchema, H as threadIdPathParams, I as optionalAgentIdQuerySchema, J as updateWorkingMemoryResponseSchema, K as updateThreadNetworkQuerySchema, L as saveMessagesBodySchema, M as listThreadsResponseSchema, N as memoryConfigResponseSchema, O as listMessagesQuerySchema, P as memoryStatusResponseSchema, R as saveMessagesNetworkQuerySchema, S as getThreadByIdQuerySchema, T as getWorkingMemoryResponseSchema, U as transferThreadBodySchema, V as searchMemoryResponseSchema, W as transferThreadResponseSchema, _ as getMemoryStatusNetworkQuerySchema, a as cloneThreadResponseSchema, b as getObservationalMemoryResponseSchema, c as deleteMessagesBodySchema, d as deleteMessagesResponseSchema, f as deleteThreadNetworkQuerySchema, g as getMemoryConfigQuerySchema, i as cloneThreadBodySchema, j as listThreadsQuerySchema, k as listMessagesResponseSchema, l as deleteMessagesNetworkQuerySchema, m as deleteThreadResponseSchema, n as awaitBufferStatusBodySchema, o as createThreadBodySchema, p as deleteThreadQuerySchema, q as updateWorkingMemoryBodySchema, r as awaitBufferStatusResponseSchema, s as createThreadNetworkQuerySchema, t as agentIdQuerySchema, u as deleteMessagesQuerySchema, v as getMemoryStatusQuerySchema, w as getWorkingMemoryQuerySchema, x as getThreadByIdNetworkQuerySchema, y as getObservationalMemoryQuerySchema, z as saveMessagesResponseSchema } from "../../memory-BxApjlTN.js";
 import { getGatewayClient, isGatewayAgentAsync, toLocalMessage, toLocalOMRecord, toLocalThread } from "./gateway-memory-client.js";
 import { Agent } from "@mastra/core/agent";

package/dist/server/handlers/plans.cjs

@@ -4,7 +4,7 @@ const require_http_exception = require("../../http-exception-CKDHupKw.cjs");
 const require_agents = require("../../agents-DwJE1tsB.cjs");
 const require_route_builder = require("../../route-builder-2yrD15TL.cjs");
 const require_server_handlers_error = require("./error.cjs");
-const require_utils = require("../../utils-aIu3gkhJ.cjs");
+const require_utils = require("../../utils-HqDZJwRc.cjs");
 const require_server_handlers_agents = require("./agents.cjs");
 let _mastra_core_tools = require("@mastra/core/tools");
 //#region src/server/handlers/plans.ts

package/dist/server/handlers/plans.js

@@ -3,7 +3,7 @@ import { t as HTTPException } from "../../http-exception-CyfxZB6W.js";
 import { a as agentIdPathParams, o as agentPlanQuerySchema, s as agentPlanResponseSchema } from "../../agents-kOz1lr_e.js";
 import { n as createRoute } from "../../route-builder-lBil8Cvo.js";
 import { handleError } from "./error.js";
-import { p as MastraFGAPermissions } from "../../utils-KsERfbhc.js";
+import { m as MastraFGAPermissions } from "../../utils-KcHk7C0D.js";
 import { getAgentFromSystem } from "./agents.js";
 import { submitPlanTool } from "@mastra/core/tools";
 //#region src/server/handlers/plans.ts

package/dist/server/handlers/responses.cjs

@@ -3,7 +3,7 @@ const require_rolldown_runtime = require("../../rolldown-runtime-Bd6kNlEP.cjs");
 const require_http_exception = require("../../http-exception-CKDHupKw.cjs");
 const require_route_builder = require("../../route-builder-2yrD15TL.cjs");
 const require_server_handlers_error = require("./error.cjs");
-const require_utils = require("../../utils-aIu3gkhJ.cjs");
+const require_utils = require("../../utils-HqDZJwRc.cjs");
 const require_server_handlers_agents = require("./agents.cjs");
 const require_responses = require("../../responses-CKNdSRkS.cjs");
 const require_server_handlers_responses_adapter = require("./responses.adapter.cjs");

package/dist/server/handlers/responses.js

@@ -2,7 +2,7 @@ import { r as __exportAll } from "../../rolldown-runtime-maW3aOIk.js";
 import { t as HTTPException } from "../../http-exception-CyfxZB6W.js";
 import { n as createRoute } from "../../route-builder-lBil8Cvo.js";
 import { handleError } from "./error.js";
-import { i as getEffectiveThreadId, p as MastraFGAPermissions, r as getEffectiveResourceId, t as enforceThreadAccess } from "../../utils-KsERfbhc.js";
+import { i as getEffectiveThreadId, m as MastraFGAPermissions, r as getEffectiveResourceId, t as enforceThreadAccess } from "../../utils-KcHk7C0D.js";
 import { getAgentFromSystem } from "./agents.js";
 import { a as deleteResponseSchema, i as createResponseBodySchema, o as responseIdPathParams, u as responseObjectSchema } from "../../responses-DJNJgCTg.js";
 import { buildCompletedResponse, buildInProgressResponse, createMessageId, createOutputTextPart, createResponseStreamEventTranslator, formatSseEvent, mapMastraToolsToResponseTools, mapResponseInputToExecutionMessages, mapResponseTurnRecordToResponse, toResponseStatus, toResponseUsage } from "./responses.adapter.js";

package/dist/server/handlers/responses.storage.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../rolldown-runtime-Bd6kNlEP.cjs");
 const require_http_exception = require("../../http-exception-CKDHupKw.cjs");
-const require_utils = require("../../utils-aIu3gkhJ.cjs");
+const require_utils = require("../../utils-HqDZJwRc.cjs");
 //#region src/server/handlers/responses.storage.ts
 function isPlainObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/server/handlers/responses.storage.js

@@ -1,5 +1,5 @@
 import { t as HTTPException } from "../../http-exception-CyfxZB6W.js";
-import { f as validateThreadOwnership, r as getEffectiveResourceId } from "../../utils-KsERfbhc.js";
+import { p as validateThreadOwnership, r as getEffectiveResourceId } from "../../utils-KcHk7C0D.js";
 //#region src/server/handlers/responses.storage.ts
 function isPlainObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/server/handlers/system.cjs

@@ -89,7 +89,7 @@ const GET_API_SCHEMA_ROUTE = require_route_builder.createRoute({
 	tags: ["System"],
 	requiresAuth: true,
 	handler: async () => {
-		const { buildApiSchemaManifest } = await Promise.resolve().then(() => require("../../api-schema-manifest-Blh5-4VH.cjs"));
+		const { buildApiSchemaManifest } = await Promise.resolve().then(() => require("../../api-schema-manifest-hJw56vOw.cjs"));
 		return buildApiSchemaManifest();
 	}
 });

package/dist/server/handlers/system.js

@@ -87,7 +87,7 @@ const GET_API_SCHEMA_ROUTE = createRoute({
 	tags: ["System"],
 	requiresAuth: true,
 	handler: async () => {
-		const { buildApiSchemaManifest } = await import("../../api-schema-manifest-BmraF-WX.js");
+		const { buildApiSchemaManifest } = await import("../../api-schema-manifest-Cg5BAmJ6.js");
 		return buildApiSchemaManifest();
 	}
 });

package/dist/server/handlers/tools.cjs

@@ -8,7 +8,7 @@ const require_route_builder = require("../../route-builder-2yrD15TL.cjs");
 require("../../schema-BVcoNfni.cjs");
 const require_utils = require("../../utils-DFQixxkO.cjs");
 const require_server_handlers_error = require("./error.cjs");
-const require_utils$1 = require("../../utils-aIu3gkhJ.cjs");
+const require_utils$1 = require("../../utils-HqDZJwRc.cjs");
 const require_server_handlers_tool_schema_overrides = require("./tool-schema-overrides.cjs");
 const require_server_handlers_agents = require("./agents.cjs");
 let _mastra_core_tools = require("@mastra/core/tools");

package/dist/server/handlers/tools.js

@@ -7,7 +7,7 @@ import { n as createRoute } from "../../route-builder-lBil8Cvo.js";
 import "../../schema-Xxr5X5Je.js";
 import { l as stringify } from "../../utils-BJm0ZYnM.js";
 import { handleError } from "./error.js";
-import { p as MastraFGAPermissions, u as validateBody } from "../../utils-KsERfbhc.js";
+import { d as validateBody, m as MastraFGAPermissions } from "../../utils-KcHk7C0D.js";
 import { stripInjectedToolOverrideFields } from "./tool-schema-overrides.js";
 import { getAgentFromSystem } from "./agents.js";
 import { isProviderDefinedTool, isVercelTool } from "@mastra/core/tools";

package/dist/server/handlers/utils.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../rolldown-runtime-Bd6kNlEP.cjs");
-const require_utils = require("../../utils-aIu3gkhJ.cjs");
+const require_utils = require("../../utils-HqDZJwRc.cjs");
 exports.enforceThreadAccess = require_utils.enforceThreadAccess;
 exports.getContextResourceId = require_utils.getContextResourceId;
 exports.getEffectiveResourceId = require_utils.getEffectiveResourceId;
@@ -10,6 +10,7 @@ exports.parseFilters = require_utils.parseFilters;
 exports.parsePerPage = require_utils.parsePerPage;
 exports.requireEffectiveResourceId = require_utils.requireEffectiveResourceId;
 exports.sanitizeBody = require_utils.sanitizeBody;
+exports.stripClientCredentialHeaders = require_utils.stripClientCredentialHeaders;
 exports.validateBody = require_utils.validateBody;
 exports.validateRunOwnership = require_utils.validateRunOwnership;
 exports.validateThreadOwnership = require_utils.validateThreadOwnership;

package/dist/server/handlers/utils.d.ts

@@ -7,6 +7,12 @@ export declare function validateBody(body: Record<string, unknown>): void;
  * @param disallowedKeys keys to remove from the body
  */
 export declare function sanitizeBody(body: Record<string, unknown>, disallowedKeys: string[]): void;
+/**
+ * Removes credential-bearing headers from client-supplied `modelSettings.headers`
+ * so a caller's own auth (e.g. the app's bearer token) can never override the
+ * provider credential configured on the server. Non-credential headers are kept.
+ */
+export declare function stripClientCredentialHeaders(body: Record<string, unknown>): void;
 export declare function parsePerPage(value: string | undefined, defaultValue?: number, max?: number): number | false;
 /**
  * Parses filter query parameters into a key-value object.

package/dist/server/handlers/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAOtD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QAWzD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,QAMnF;AAED,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,YAAY,GAAE,MAAY,EAC1B,GAAG,GAAE,MAAa,GACjB,MAAM,GAAG,KAAK,CAShB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAUvG;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,oBAAoB,EAAE,cAAc,EAAE,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAW/G;AAMD;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,cAAc,GAAG,SAAS,EAC1C,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,MAAM,GAAG,SAAS,CAGpB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAEnG;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,mBAAmB,EAAE,MAAM,GAAG,SAAS,GACtC,OAAO,CAAC,mBAAmB,IAAI,MAAM,CAOvC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,cAAc,GAAG,SAAS,EAC1C,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,MAAM,GAAG,SAAS,CAGpB;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EACzD,mBAAmB,EAAE,MAAM,GAAG,SAAS,GACtC,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,MAAM,EACN,cAAc,EACd,QAAQ,EACR,MAAM,EACN,mBAAmB,EACnB,UAA6C,GAC9C,EAAE;IACD,MAAM,EAAE,GAAG,CAAC;IACZ,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/C,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,CAAC,EAAE,wBAAwB,CAAC;CACvC,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EACtD,mBAAmB,EAAE,MAAM,GAAG,SAAS,GACtC,OAAO,CAAC,IAAI,CAAC,CAIf"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAOtD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QAWzD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,QAMnF;AAWD;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QAUzE;AAED,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,YAAY,GAAE,MAAY,EAC1B,GAAG,GAAE,MAAa,GACjB,MAAM,GAAG,KAAK,CAShB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAUvG;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,oBAAoB,EAAE,cAAc,EAAE,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAW/G;AAMD;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,cAAc,GAAG,SAAS,EAC1C,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,MAAM,GAAG,SAAS,CAGpB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAEnG;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,mBAAmB,EAAE,MAAM,GAAG,SAAS,GACtC,OAAO,CAAC,mBAAmB,IAAI,MAAM,CAOvC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,cAAc,GAAG,SAAS,EAC1C,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,MAAM,GAAG,SAAS,CAGpB;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EACzD,mBAAmB,EAAE,MAAM,GAAG,SAAS,GACtC,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,MAAM,EACN,cAAc,EACd,QAAQ,EACR,MAAM,EACN,mBAAmB,EACnB,UAA6C,GAC9C,EAAE;IACD,MAAM,EAAE,GAAG,CAAC;IACZ,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/C,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,CAAC,EAAE,wBAAwB,CAAC;CACvC,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EACtD,mBAAmB,EAAE,MAAM,GAAG,SAAS,GACtC,OAAO,CAAC,IAAI,CAAC,CAIf"}

package/dist/server/handlers/utils.js

@@ -1,2 +1,2 @@
-import { a as mergeBodyRequestContext, c as requireEffectiveResourceId, d as validateRunOwnership, f as validateThreadOwnership, i as getEffectiveThreadId, l as sanitizeBody, n as getContextResourceId, o as parseFilters, r as getEffectiveResourceId, s as parsePerPage, t as enforceThreadAccess, u as validateBody } from "../../utils-KsERfbhc.js";
-export { enforceThreadAccess, getContextResourceId, getEffectiveResourceId, getEffectiveThreadId, mergeBodyRequestContext, parseFilters, parsePerPage, requireEffectiveResourceId, sanitizeBody, validateBody, validateRunOwnership, validateThreadOwnership };
+import { a as mergeBodyRequestContext, c as requireEffectiveResourceId, d as validateBody, f as validateRunOwnership, i as getEffectiveThreadId, l as sanitizeBody, n as getContextResourceId, o as parseFilters, p as validateThreadOwnership, r as getEffectiveResourceId, s as parsePerPage, t as enforceThreadAccess, u as stripClientCredentialHeaders } from "../../utils-KcHk7C0D.js";
+export { enforceThreadAccess, getContextResourceId, getEffectiveResourceId, getEffectiveThreadId, mergeBodyRequestContext, parseFilters, parsePerPage, requireEffectiveResourceId, sanitizeBody, stripClientCredentialHeaders, validateBody, validateRunOwnership, validateThreadOwnership };

package/dist/server/handlers/workflow-builder.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../rolldown-runtime-Bd6kNlEP.cjs");
-const require_workflow_builder = require("../../workflow-builder-DTcM8ER3.cjs");
+const require_workflow_builder = require("../../workflow-builder-BSjQJCVD.cjs");
 exports.GET_WORKFLOW_BUILDER_SETTINGS_ROUTE = require_workflow_builder.GET_WORKFLOW_BUILDER_SETTINGS_ROUTE;
 exports.STREAM_WORKFLOW_BUILDER_ROUTE = require_workflow_builder.STREAM_WORKFLOW_BUILDER_ROUTE;

package/dist/server/handlers/workflow-builder.js

@@ -1,2 +1,2 @@
-import { n as STREAM_WORKFLOW_BUILDER_ROUTE, t as GET_WORKFLOW_BUILDER_SETTINGS_ROUTE } from "../../workflow-builder-KRSpDol2.js";
+import { n as STREAM_WORKFLOW_BUILDER_ROUTE, t as GET_WORKFLOW_BUILDER_SETTINGS_ROUTE } from "../../workflow-builder-DJ48IzXQ.js";
 export { GET_WORKFLOW_BUILDER_SETTINGS_ROUTE, STREAM_WORKFLOW_BUILDER_ROUTE };

package/dist/server/handlers/workflows.cjs

@@ -7,7 +7,7 @@ const require_agents = require("../../agents-DwJE1tsB.cjs");
 const require_route_builder = require("../../route-builder-2yrD15TL.cjs");
 const require_utils = require("../../utils-DFQixxkO.cjs");
 const require_server_handlers_error = require("./error.cjs");
-const require_utils$1 = require("../../utils-aIu3gkhJ.cjs");
+const require_utils$1 = require("../../utils-HqDZJwRc.cjs");
 let zod_v4 = require("zod/v4");
 let _mastra_core_stream = require("@mastra/core/stream");
 //#region src/server/handlers/workflows.ts

package/dist/server/handlers/workflows.js

@@ -6,7 +6,7 @@ import { J as streamResponseSchema } from "../../agents-kOz1lr_e.js";
 import { n as createRoute } from "../../route-builder-lBil8Cvo.js";
 import { a as getWorkflowInfo, t as WorkflowRegistry } from "../../utils-BJm0ZYnM.js";
 import { handleError } from "./error.js";
-import { d as validateRunOwnership, p as MastraFGAPermissions, r as getEffectiveResourceId } from "../../utils-KsERfbhc.js";
+import { f as validateRunOwnership, m as MastraFGAPermissions, r as getEffectiveResourceId } from "../../utils-KcHk7C0D.js";
 import { z } from "zod/v4";
 import { createReplayStream } from "@mastra/core/stream";
 //#region src/server/handlers/workflows.ts

package/dist/server/server-adapter/index.cjs

@@ -6,7 +6,7 @@ const require_utils = require("../../utils-DFQixxkO.cjs");
 const require_constants = require("../../constants-4IJp_uzj.cjs");
 const require_server_handlers_error = require("../handlers/error.cjs");
 const require_helpers = require("../../helpers-8jl_xtug.cjs");
-const require_routes = require("../../routes-CcjyQojv.cjs");
+const require_routes = require("../../routes-mJga4N4C.cjs");
 let zod_v4 = require("zod/v4");
 let stream = require("stream");
 let _mastra_core_request_context = require("@mastra/core/request-context");

package/dist/server/server-adapter/index.js

@@ -4,7 +4,7 @@ import { o as normalizeRoutePath, t as WorkflowRegistry } from "../../utils-BJm0
 import { i as MASTRA_IS_STUDIO_KEY, l as MASTRA_USER_KEY, m as isStudioClientTypeHeader, n as MASTRA_AUTH_TOKEN_KEY, o as MASTRA_RESOURCE_ID_KEY$1, p as isReservedRequestContextKey, r as MASTRA_CLIENT_TYPE_HEADER, s as MASTRA_STUDIO_CLIENT_TYPE, t as MASTRA_AUTH_MODE_KEY } from "../../constants-0jFCWoex.js";
 import { formatZodError, isZodError } from "../handlers/error.js";
 import { d as pathMatchesPattern, i as findMatchingCustomRoute, o as isCustomRoutePublic, r as coreAuthMiddleware } from "../../helpers-610L0lwQ.js";
-import { t as SERVER_ROUTES } from "../../routes-Boe1UThy.js";
+import { t as SERVER_ROUTES } from "../../routes-obDo67aE.js";
 import { z } from "zod/v4";
 import { Readable } from "stream";
 import { RequestContext } from "@mastra/core/request-context";

package/dist/{utils-aIu3gkhJ.cjs → utils-HqDZJwRc.cjs}

@@ -68,6 +68,30 @@ function validateBody(body) {
 function sanitizeBody(body, disallowedKeys) {
 	for (const key of disallowedKeys) if (key in body) delete body[key];
 }
+const CREDENTIAL_HEADER_NAMES = /* @__PURE__ */ new Set([
+	"authorization",
+	"proxy-authorization",
+	"x-api-key",
+	"api-key",
+	"x-goog-api-key",
+	"cookie"
+]);
+/**
+* Removes credential-bearing headers from client-supplied `modelSettings.headers`
+* so a caller's own auth (e.g. the app's bearer token) can never override the
+* provider credential configured on the server. Non-credential headers are kept.
+*/
+function stripClientCredentialHeaders(body) {
+	const modelSettings = body.modelSettings;
+	if (!modelSettings || typeof modelSettings !== "object") return;
+	const headers = modelSettings.headers;
+	if (!headers || typeof headers !== "object") return;
+	const kept = Object.fromEntries(Object.entries(headers).filter(([name]) => !CREDENTIAL_HEADER_NAMES.has(name.toLowerCase())));
+	body.modelSettings = {
+		...modelSettings,
+		headers: kept
+	};
+}
 function parsePerPage(value, defaultValue = 100, max = 1e3) {
 	if ((value || "").trim().toLowerCase() === "false") return false;
 	const parsed = parseInt(value || String(defaultValue), 10);
@@ -223,6 +247,12 @@ Object.defineProperty(exports, "sanitizeBody", {
 		return sanitizeBody;
 	}
 });
+Object.defineProperty(exports, "stripClientCredentialHeaders", {
+	enumerable: true,
+	get: function() {
+		return stripClientCredentialHeaders;
+	}
+});
 Object.defineProperty(exports, "validateBody", {
 	enumerable: true,
 	get: function() {
@@ -242,4 +272,4 @@ Object.defineProperty(exports, "validateThreadOwnership", {
 	}
 });
 
-//# sourceMappingURL=utils-aIu3gkhJ.cjs.map
+//# sourceMappingURL=utils-HqDZJwRc.cjs.map

package/dist/utils-HqDZJwRc.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils-HqDZJwRc.cjs","names":["authEE","HTTPException","isReservedRequestContextKey","MASTRA_RESOURCE_ID_KEY","MastraMemory"],"sources":["../src/server/fga-permissions.ts","../src/server/handlers/utils.ts"],"sourcesContent":["/**\n * Safe re-export of `MastraFGAPermissions` from `@mastra/core/auth/ee`.\n *\n * Why this shim exists:\n * `MastraFGAPermissions` was introduced in `@mastra/core@1.32.0`. Earlier\n * versions of `@mastra/core` ship `@mastra/core/auth/ee` but do not export\n * this constant. A direct named import (`import { MastraFGAPermissions }\n * from '@mastra/core/auth/ee'`) fails at ESM link time when this version\n * of `@mastra/server` is paired with `@mastra/core < 1.32.0`, taking the\n * entire user bundle down before any code runs.\n *\n * A namespace import tolerates missing names — `ns.MissingExport` is just\n * `undefined`, no link-time error. We then expose the permission map.\n *\n * Fallback values:\n * If the consuming `@mastra/core` does not export `MastraFGAPermissions`,\n * we substitute a hardcoded map of the canonical permission strings used\n * by routes in `@mastra/server`. This preserves the explicit RBAC\n * permission overrides those routes already had as string literals in\n * `@mastra/server@1.31.0` (e.g. `requiresPermission: \"agents:execute\"`\n * on `/v1/responses`). Without this fallback, `requiresPermission` would\n * be `undefined` on old core and the auth layer would derive the wrong\n * permission from the route path (e.g. `v1:write` instead of\n * `agents:execute`), breaking RBAC users who upgrade `@mastra/server`\n * but stay on `@mastra/core@1.31.0`.\n *\n * Once the consuming `@mastra/core` is on `1.32.0+` the values are real\n * and behaviour is identical to a direct named import.\n */\n\nimport * as authEE from '@mastra/core/auth/ee';\n\n// Canonical strings for the FGA permission keys actually referenced by\n// `@mastra/server` source. Mirrors `MastraFGAPermissions` in\n// `@mastra/core@1.32.0+` for these specific keys, and matches the string\n// literals previously hardcoded on the same routes in `@mastra/server@1.31.0`.\nconst FALLBACK_PERMISSIONS = {\n  AGENTS_CREATE: 'agents:create',\n  AGENTS_DELETE: 'agents:delete',\n  AGENTS_EXECUTE: 'agents:execute',\n  AGENTS_READ: 'agents:read',\n  MEMORY_DELETE: 'memory:delete',\n  MEMORY_READ: 'memory:read',\n  MEMORY_WRITE: 'memory:write',\n  TOOLS_EXECUTE: 'tools:execute',\n  TOOLS_READ: 'tools:read',\n  STORED_WORKFLOWS_READ: 'stored-workflows:read',\n  STORED_WORKFLOWS_WRITE: 'stored-workflows:write',\n  WORKFLOWS_EXECUTE: 'workflows:execute',\n  WORKFLOWS_READ: 'workflows:read',\n} as const;\n\nconst realPermissions = (authEE as any).MastraFGAPermissions;\n\n// Typed as `any` on purpose: consumers of `@mastra/server` may run their\n// typecheck against a `@mastra/core` that doesn't export `MastraFGAPermissions`\n// (anything < 1.32.0). Pinning to the real type would push that name into the\n// emitted `.d.ts` and break downstream typecheck. `any` lets the property\n// accesses (`MastraFGAPermissions.AGENTS_READ`) flow through cleanly on every\n// supported core.\nexport const MastraFGAPermissions: any =\n  realPermissions && Object.keys(realPermissions).length > 0 ? realPermissions : FALLBACK_PERMISSIONS;\n","import type { MastraFGAPermissionInput } from '@mastra/core/auth/ee';\nimport type { RequestContext } from '@mastra/core/di';\nimport { MastraMemory } from '@mastra/core/memory';\nimport { MASTRA_RESOURCE_ID_KEY, MASTRA_THREAD_ID_KEY, isReservedRequestContextKey } from '../constants';\nimport { MastraFGAPermissions } from '../fga-permissions';\nimport { HTTPException } from '../http-exception';\n\n// Validation helper\nexport function validateBody(body: Record<string, unknown>) {\n  const errorResponse = Object.entries(body).reduce<Record<string, string>>((acc, [key, value]) => {\n    if (!value) {\n      acc[key] = `Argument \"${key}\" is required`;\n    }\n    return acc;\n  }, {});\n\n  if (Object.keys(errorResponse).length > 0) {\n    throw new HTTPException(400, { message: Object.values(errorResponse)[0] });\n  }\n}\n\n/**\n * sanitizes the body by removing disallowed keys.\n * @param body body to sanitize\n * @param disallowedKeys keys to remove from the body\n */\nexport function sanitizeBody(body: Record<string, unknown>, disallowedKeys: string[]) {\n  for (const key of disallowedKeys) {\n    if (key in body) {\n      delete body[key];\n    }\n  }\n}\n\nconst CREDENTIAL_HEADER_NAMES = new Set([\n  'authorization',\n  'proxy-authorization',\n  'x-api-key',\n  'api-key',\n  'x-goog-api-key',\n  'cookie',\n]);\n\n/**\n * Removes credential-bearing headers from client-supplied `modelSettings.headers`\n * so a caller's own auth (e.g. the app's bearer token) can never override the\n * provider credential configured on the server. Non-credential headers are kept.\n */\nexport function stripClientCredentialHeaders(body: Record<string, unknown>) {\n  const modelSettings = body.modelSettings;\n  if (!modelSettings || typeof modelSettings !== 'object') return;\n  const headers = (modelSettings as { headers?: unknown }).headers;\n  if (!headers || typeof headers !== 'object') return;\n\n  const kept = Object.fromEntries(\n    Object.entries(headers).filter(([name]) => !CREDENTIAL_HEADER_NAMES.has(name.toLowerCase())),\n  );\n  body.modelSettings = { ...modelSettings, headers: kept };\n}\n\nexport function parsePerPage(\n  value: string | undefined,\n  defaultValue: number = 100,\n  max: number = 1000,\n): number | false {\n  const normalized = (value || '').trim().toLowerCase();\n  // Handle explicit false to bypass pagination\n  if (normalized === 'false') {\n    return false;\n  }\n  const parsed = parseInt(value || String(defaultValue), 10);\n  if (isNaN(parsed)) return defaultValue;\n  return Math.min(max, Math.max(1, parsed));\n}\n\n/**\n * Parses filter query parameters into a key-value object.\n */\nexport function parseFilters(filters: string | string[] | undefined): Record<string, string> | undefined {\n  if (!filters) return undefined;\n\n  return Object.fromEntries(\n    (Array.isArray(filters) ? filters : [filters]).map((attr: string) => {\n      const [key, ...valueParts] = attr.split(':');\n      const value = valueParts.join(':'); // ✅ Handles colons in values\n      return [key, value];\n    }),\n  );\n}\n\n/**\n * Merges a body-supplied requestContext into the trusted server RequestContext.\n * The server context is authoritative: reserved keys are skipped and body values\n * only fill keys the server context has not already set.\n */\nexport function mergeBodyRequestContext(serverRequestContext: RequestContext, bodyRequestContext: unknown): void {\n  if (!bodyRequestContext || typeof bodyRequestContext !== 'object') {\n    return;\n  }\n\n  for (const [key, value] of Object.entries(bodyRequestContext)) {\n    if (isReservedRequestContextKey(key)) continue;\n    if (serverRequestContext.get(key) === undefined) {\n      serverRequestContext.set(key, value);\n    }\n  }\n}\n\n// ============================================================================\n// Authorization Utilities\n// ============================================================================\n\n/**\n * Gets the effective resourceId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveResourceId(\n  requestContext: RequestContext | undefined,\n  clientResourceId: string | undefined,\n): string | undefined {\n  const contextResourceId = requestContext?.get(MASTRA_RESOURCE_ID_KEY) as string | undefined;\n  return contextResourceId || clientResourceId;\n}\n\n/**\n * Returns the resource id resolved from the request context alone (set via\n * `mapUserToResourceId` or the `x-resource-id` header), ignoring any\n * client-provided value. Its presence indicates a resource-scoped caller;\n * its absence indicates a privileged/service context.\n */\nexport function getContextResourceId(requestContext: RequestContext | undefined): string | undefined {\n  return requestContext?.get(MASTRA_RESOURCE_ID_KEY) as string | undefined;\n}\n\n/**\n * Ensures a memory request has a resolvable resource ID. The body's\n * `memory.resource` is optional so authenticated setups can rely on the\n * server-derived resource ID (MASTRA_RESOURCE_ID_KEY set via mapUserToResourceId).\n * When neither the body nor the request context provides one, reject with a\n * clear 400 instead of failing deep inside agent execution.\n */\nexport function requireEffectiveResourceId(\n  effectiveResourceId: string | undefined,\n): asserts effectiveResourceId is string {\n  if (!effectiveResourceId) {\n    throw new HTTPException(400, {\n      message:\n        'A resource ID is required when using memory. Provide memory.resource in the request body, or configure server auth with mapUserToResourceId to derive it from the authenticated user.',\n    });\n  }\n}\n\n/**\n * Gets the effective threadId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveThreadId(\n  requestContext: RequestContext | undefined,\n  clientThreadId: string | undefined,\n): string | undefined {\n  const contextThreadId = requestContext?.get(MASTRA_THREAD_ID_KEY) as string | undefined;\n  return contextThreadId || clientThreadId;\n}\n\n/**\n * Validates that a thread belongs to the specified resourceId.\n * Throws 403 if the thread exists but belongs to a different resource.\n * Threads with no resourceId are accessible to all (shared threads).\n */\nexport async function validateThreadOwnership(\n  thread: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (thread && effectiveResourceId && thread.resourceId && thread.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: thread belongs to a different resource' });\n  }\n}\n\n/**\n * Validates both coarse resource ownership and fine-grained thread access.\n * FGA enforcement is a no-op when no FGA provider is configured.\n */\nexport async function enforceThreadAccess({\n  mastra,\n  requestContext,\n  threadId,\n  thread,\n  effectiveResourceId,\n  permission = MastraFGAPermissions.MEMORY_READ,\n}: {\n  mastra: any;\n  requestContext?: RequestContext;\n  threadId: string;\n  thread?: { resourceId?: string | null } | null;\n  effectiveResourceId?: string;\n  permission?: MastraFGAPermissionInput;\n}): Promise<void> {\n  await validateThreadOwnership(thread, effectiveResourceId);\n\n  const fgaProvider = mastra?.getServer?.()?.fga;\n  if (!fgaProvider) {\n    return;\n  }\n\n  const user = requestContext?.get('user');\n  if (!user || typeof user !== 'object') {\n    throw new HTTPException(403, { message: 'FGA authorization denied: authenticated user is required' });\n  }\n\n  await MastraMemory.checkThreadFGA({\n    mastra,\n    user: user as { id: string; [key: string]: unknown },\n    threadId,\n    resourceId: thread?.resourceId ?? effectiveResourceId,\n    requestContext,\n    permission,\n  });\n}\n\n/**\n * Validates that a workflow run belongs to the specified resourceId.\n * Throws 403 if the run exists but belongs to a different resource.\n */\nexport async function validateRunOwnership(\n  run: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (run && effectiveResourceId && run.resourceId && run.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: workflow run belongs to a different resource' });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,MAAM,uBAAuB;CAC3B,eAAe;CACf,eAAe;CACf,gBAAgB;CAChB,aAAa;CACb,eAAe;CACf,aAAa;CACb,cAAc;CACd,eAAe;CACf,YAAY;CACZ,uBAAuB;CACvB,wBAAwB;CACxB,mBAAmB;CACnB,gBAAgB;AAClB;AAEA,MAAM,kBAAmBA,qBAAe;AAQxC,MAAa,uBACX,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,IAAI,kBAAkB;;;ACrDjF,SAAgB,aAAa,MAA+B;CAC1D,MAAM,gBAAgB,OAAO,QAAQ,IAAI,CAAC,CAAC,QAAgC,KAAK,CAAC,KAAK,WAAW;EAC/F,IAAI,CAAC,OACH,IAAI,OAAO,aAAa,IAAI;EAE9B,OAAO;CACT,GAAG,CAAC,CAAC;CAEL,IAAI,OAAO,KAAK,aAAa,CAAC,CAAC,SAAS,GACtC,MAAM,IAAIC,uBAAAA,cAAc,KAAK,EAAE,SAAS,OAAO,OAAO,aAAa,CAAC,CAAC,GAAG,CAAC;AAE7E;;;;;;AAOA,SAAgB,aAAa,MAA+B,gBAA0B;CACpF,KAAK,MAAM,OAAO,gBAChB,IAAI,OAAO,MACT,OAAO,KAAK;AAGlB;AAEA,MAAM,0CAA0B,IAAI,IAAI;CACtC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,SAAgB,6BAA6B,MAA+B;CAC1E,MAAM,gBAAgB,KAAK;CAC3B,IAAI,CAAC,iBAAiB,OAAO,kBAAkB,UAAU;CACzD,MAAM,UAAW,cAAwC;CACzD,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU;CAE7C,MAAM,OAAO,OAAO,YAClB,OAAO,QAAQ,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,wBAAwB,IAAI,KAAK,YAAY,CAAC,CAAC,CAC7F;CACA,KAAK,gBAAgB;EAAE,GAAG;EAAe,SAAS;CAAK;AACzD;AAEA,SAAgB,aACd,OACA,eAAuB,KACvB,MAAc,KACE;CAGhB,KAFoB,SAAS,GAAA,CAAI,KAAK,CAAC,CAAC,YAE3B,MAAM,SACjB,OAAO;CAET,MAAM,SAAS,SAAS,SAAS,OAAO,YAAY,GAAG,EAAE;CACzD,IAAI,MAAM,MAAM,GAAG,OAAO;CAC1B,OAAO,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,MAAM,CAAC;AAC1C;;;;AAKA,SAAgB,aAAa,SAA4E;CACvG,IAAI,CAAC,SAAS,OAAO,KAAA;CAErB,OAAO,OAAO,aACX,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO,EAAA,CAAG,KAAK,SAAiB;EACnE,MAAM,CAAC,KAAK,GAAG,cAAc,KAAK,MAAM,GAAG;EAE3C,OAAO,CAAC,KADM,WAAW,KAAK,GACb,CAAC;CACpB,CAAC,CACH;AACF;;;;;;AAOA,SAAgB,wBAAwB,sBAAsC,oBAAmC;CAC/G,IAAI,CAAC,sBAAsB,OAAO,uBAAuB,UACvD;CAGF,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,kBAAkB,GAAG;EAC7D,IAAIC,kBAAAA,4BAA4B,GAAG,GAAG;EACtC,IAAI,qBAAqB,IAAI,GAAG,MAAM,KAAA,GACpC,qBAAqB,IAAI,KAAK,KAAK;CAEvC;AACF;;;;;AAUA,SAAgB,uBACd,gBACA,kBACoB;CAEpB,OAD0B,gBAAgB,IAAA,oBAA0B,KACxC;AAC9B;;;;;;;AAQA,SAAgB,qBAAqB,gBAAgE;CACnG,OAAO,gBAAgB,IAAIC,kBAAAA,sBAAsB;AACnD;;;;;;;;AASA,SAAgB,2BACd,qBACuC;CACvC,IAAI,CAAC,qBACH,MAAM,IAAIF,uBAAAA,cAAc,KAAK,EAC3B,SACE,wLACJ,CAAC;AAEL;;;;;AAMA,SAAgB,qBACd,gBACA,gBACoB;CAEpB,OADwB,gBAAgB,IAAA,kBAAwB,KACtC;AAC5B;;;;;;AAOA,eAAsB,wBACpB,QACA,qBACe;CACf,IAAI,UAAU,uBAAuB,OAAO,cAAc,OAAO,eAAe,qBAC9E,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,wDAAwD,CAAC;AAErG;;;;;AAMA,eAAsB,oBAAoB,EACxC,QACA,gBACA,UACA,QACA,qBACA,aAAa,qBAAqB,eAQlB;CAChB,MAAM,wBAAwB,QAAQ,mBAAmB;CAGzD,IAAI,CADgB,QAAQ,YAAY,CAAC,EAAE,KAEzC;CAGF,MAAM,OAAO,gBAAgB,IAAI,MAAM;CACvC,IAAI,CAAC,QAAQ,OAAO,SAAS,UAC3B,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,2DAA2D,CAAC;CAGtG,MAAMG,oBAAAA,aAAa,eAAe;EAChC;EACM;EACN;EACA,YAAY,QAAQ,cAAc;EAClC;EACA;CACF,CAAC;AACH;;;;;AAMA,eAAsB,qBACpB,KACA,qBACe;CACf,IAAI,OAAO,uBAAuB,IAAI,cAAc,IAAI,eAAe,qBACrE,MAAM,IAAIH,uBAAAA,cAAc,KAAK,EAAE,SAAS,8DAA8D,CAAC;AAE3G"}

package/dist/{utils-KsERfbhc.js → utils-KcHk7C0D.js}

@@ -66,6 +66,30 @@ function validateBody(body) {
 function sanitizeBody(body, disallowedKeys) {
 	for (const key of disallowedKeys) if (key in body) delete body[key];
 }
+const CREDENTIAL_HEADER_NAMES = /* @__PURE__ */ new Set([
+	"authorization",
+	"proxy-authorization",
+	"x-api-key",
+	"api-key",
+	"x-goog-api-key",
+	"cookie"
+]);
+/**
+* Removes credential-bearing headers from client-supplied `modelSettings.headers`
+* so a caller's own auth (e.g. the app's bearer token) can never override the
+* provider credential configured on the server. Non-credential headers are kept.
+*/
+function stripClientCredentialHeaders(body) {
+	const modelSettings = body.modelSettings;
+	if (!modelSettings || typeof modelSettings !== "object") return;
+	const headers = modelSettings.headers;
+	if (!headers || typeof headers !== "object") return;
+	const kept = Object.fromEntries(Object.entries(headers).filter(([name]) => !CREDENTIAL_HEADER_NAMES.has(name.toLowerCase())));
+	body.modelSettings = {
+		...modelSettings,
+		headers: kept
+	};
+}
 function parsePerPage(value, defaultValue = 100, max = 1e3) {
 	if ((value || "").trim().toLowerCase() === "false") return false;
 	const parsed = parseInt(value || String(defaultValue), 10);
@@ -161,6 +185,6 @@ async function validateRunOwnership(run, effectiveResourceId) {
 	if (run && effectiveResourceId && run.resourceId && run.resourceId !== effectiveResourceId) throw new HTTPException(403, { message: "Access denied: workflow run belongs to a different resource" });
 }
 //#endregion
-export { mergeBodyRequestContext as a, requireEffectiveResourceId as c, validateRunOwnership as d, validateThreadOwnership as f, getEffectiveThreadId as i, sanitizeBody as l, getContextResourceId as n, parseFilters as o, MastraFGAPermissions as p, getEffectiveResourceId as r, parsePerPage as s, enforceThreadAccess as t, validateBody as u };
+export { mergeBodyRequestContext as a, requireEffectiveResourceId as c, validateBody as d, validateRunOwnership as f, getEffectiveThreadId as i, sanitizeBody as l, MastraFGAPermissions as m, getContextResourceId as n, parseFilters as o, validateThreadOwnership as p, getEffectiveResourceId as r, parsePerPage as s, enforceThreadAccess as t, stripClientCredentialHeaders as u };
 
-//# sourceMappingURL=utils-KsERfbhc.js.map
+//# sourceMappingURL=utils-KcHk7C0D.js.map

package/dist/utils-KcHk7C0D.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils-KcHk7C0D.js","names":[],"sources":["../src/server/fga-permissions.ts","../src/server/handlers/utils.ts"],"sourcesContent":["/**\n * Safe re-export of `MastraFGAPermissions` from `@mastra/core/auth/ee`.\n *\n * Why this shim exists:\n * `MastraFGAPermissions` was introduced in `@mastra/core@1.32.0`. Earlier\n * versions of `@mastra/core` ship `@mastra/core/auth/ee` but do not export\n * this constant. A direct named import (`import { MastraFGAPermissions }\n * from '@mastra/core/auth/ee'`) fails at ESM link time when this version\n * of `@mastra/server` is paired with `@mastra/core < 1.32.0`, taking the\n * entire user bundle down before any code runs.\n *\n * A namespace import tolerates missing names — `ns.MissingExport` is just\n * `undefined`, no link-time error. We then expose the permission map.\n *\n * Fallback values:\n * If the consuming `@mastra/core` does not export `MastraFGAPermissions`,\n * we substitute a hardcoded map of the canonical permission strings used\n * by routes in `@mastra/server`. This preserves the explicit RBAC\n * permission overrides those routes already had as string literals in\n * `@mastra/server@1.31.0` (e.g. `requiresPermission: \"agents:execute\"`\n * on `/v1/responses`). Without this fallback, `requiresPermission` would\n * be `undefined` on old core and the auth layer would derive the wrong\n * permission from the route path (e.g. `v1:write` instead of\n * `agents:execute`), breaking RBAC users who upgrade `@mastra/server`\n * but stay on `@mastra/core@1.31.0`.\n *\n * Once the consuming `@mastra/core` is on `1.32.0+` the values are real\n * and behaviour is identical to a direct named import.\n */\n\nimport * as authEE from '@mastra/core/auth/ee';\n\n// Canonical strings for the FGA permission keys actually referenced by\n// `@mastra/server` source. Mirrors `MastraFGAPermissions` in\n// `@mastra/core@1.32.0+` for these specific keys, and matches the string\n// literals previously hardcoded on the same routes in `@mastra/server@1.31.0`.\nconst FALLBACK_PERMISSIONS = {\n  AGENTS_CREATE: 'agents:create',\n  AGENTS_DELETE: 'agents:delete',\n  AGENTS_EXECUTE: 'agents:execute',\n  AGENTS_READ: 'agents:read',\n  MEMORY_DELETE: 'memory:delete',\n  MEMORY_READ: 'memory:read',\n  MEMORY_WRITE: 'memory:write',\n  TOOLS_EXECUTE: 'tools:execute',\n  TOOLS_READ: 'tools:read',\n  STORED_WORKFLOWS_READ: 'stored-workflows:read',\n  STORED_WORKFLOWS_WRITE: 'stored-workflows:write',\n  WORKFLOWS_EXECUTE: 'workflows:execute',\n  WORKFLOWS_READ: 'workflows:read',\n} as const;\n\nconst realPermissions = (authEE as any).MastraFGAPermissions;\n\n// Typed as `any` on purpose: consumers of `@mastra/server` may run their\n// typecheck against a `@mastra/core` that doesn't export `MastraFGAPermissions`\n// (anything < 1.32.0). Pinning to the real type would push that name into the\n// emitted `.d.ts` and break downstream typecheck. `any` lets the property\n// accesses (`MastraFGAPermissions.AGENTS_READ`) flow through cleanly on every\n// supported core.\nexport const MastraFGAPermissions: any =\n  realPermissions && Object.keys(realPermissions).length > 0 ? realPermissions : FALLBACK_PERMISSIONS;\n","import type { MastraFGAPermissionInput } from '@mastra/core/auth/ee';\nimport type { RequestContext } from '@mastra/core/di';\nimport { MastraMemory } from '@mastra/core/memory';\nimport { MASTRA_RESOURCE_ID_KEY, MASTRA_THREAD_ID_KEY, isReservedRequestContextKey } from '../constants';\nimport { MastraFGAPermissions } from '../fga-permissions';\nimport { HTTPException } from '../http-exception';\n\n// Validation helper\nexport function validateBody(body: Record<string, unknown>) {\n  const errorResponse = Object.entries(body).reduce<Record<string, string>>((acc, [key, value]) => {\n    if (!value) {\n      acc[key] = `Argument \"${key}\" is required`;\n    }\n    return acc;\n  }, {});\n\n  if (Object.keys(errorResponse).length > 0) {\n    throw new HTTPException(400, { message: Object.values(errorResponse)[0] });\n  }\n}\n\n/**\n * sanitizes the body by removing disallowed keys.\n * @param body body to sanitize\n * @param disallowedKeys keys to remove from the body\n */\nexport function sanitizeBody(body: Record<string, unknown>, disallowedKeys: string[]) {\n  for (const key of disallowedKeys) {\n    if (key in body) {\n      delete body[key];\n    }\n  }\n}\n\nconst CREDENTIAL_HEADER_NAMES = new Set([\n  'authorization',\n  'proxy-authorization',\n  'x-api-key',\n  'api-key',\n  'x-goog-api-key',\n  'cookie',\n]);\n\n/**\n * Removes credential-bearing headers from client-supplied `modelSettings.headers`\n * so a caller's own auth (e.g. the app's bearer token) can never override the\n * provider credential configured on the server. Non-credential headers are kept.\n */\nexport function stripClientCredentialHeaders(body: Record<string, unknown>) {\n  const modelSettings = body.modelSettings;\n  if (!modelSettings || typeof modelSettings !== 'object') return;\n  const headers = (modelSettings as { headers?: unknown }).headers;\n  if (!headers || typeof headers !== 'object') return;\n\n  const kept = Object.fromEntries(\n    Object.entries(headers).filter(([name]) => !CREDENTIAL_HEADER_NAMES.has(name.toLowerCase())),\n  );\n  body.modelSettings = { ...modelSettings, headers: kept };\n}\n\nexport function parsePerPage(\n  value: string | undefined,\n  defaultValue: number = 100,\n  max: number = 1000,\n): number | false {\n  const normalized = (value || '').trim().toLowerCase();\n  // Handle explicit false to bypass pagination\n  if (normalized === 'false') {\n    return false;\n  }\n  const parsed = parseInt(value || String(defaultValue), 10);\n  if (isNaN(parsed)) return defaultValue;\n  return Math.min(max, Math.max(1, parsed));\n}\n\n/**\n * Parses filter query parameters into a key-value object.\n */\nexport function parseFilters(filters: string | string[] | undefined): Record<string, string> | undefined {\n  if (!filters) return undefined;\n\n  return Object.fromEntries(\n    (Array.isArray(filters) ? filters : [filters]).map((attr: string) => {\n      const [key, ...valueParts] = attr.split(':');\n      const value = valueParts.join(':'); // ✅ Handles colons in values\n      return [key, value];\n    }),\n  );\n}\n\n/**\n * Merges a body-supplied requestContext into the trusted server RequestContext.\n * The server context is authoritative: reserved keys are skipped and body values\n * only fill keys the server context has not already set.\n */\nexport function mergeBodyRequestContext(serverRequestContext: RequestContext, bodyRequestContext: unknown): void {\n  if (!bodyRequestContext || typeof bodyRequestContext !== 'object') {\n    return;\n  }\n\n  for (const [key, value] of Object.entries(bodyRequestContext)) {\n    if (isReservedRequestContextKey(key)) continue;\n    if (serverRequestContext.get(key) === undefined) {\n      serverRequestContext.set(key, value);\n    }\n  }\n}\n\n// ============================================================================\n// Authorization Utilities\n// ============================================================================\n\n/**\n * Gets the effective resourceId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveResourceId(\n  requestContext: RequestContext | undefined,\n  clientResourceId: string | undefined,\n): string | undefined {\n  const contextResourceId = requestContext?.get(MASTRA_RESOURCE_ID_KEY) as string | undefined;\n  return contextResourceId || clientResourceId;\n}\n\n/**\n * Returns the resource id resolved from the request context alone (set via\n * `mapUserToResourceId` or the `x-resource-id` header), ignoring any\n * client-provided value. Its presence indicates a resource-scoped caller;\n * its absence indicates a privileged/service context.\n */\nexport function getContextResourceId(requestContext: RequestContext | undefined): string | undefined {\n  return requestContext?.get(MASTRA_RESOURCE_ID_KEY) as string | undefined;\n}\n\n/**\n * Ensures a memory request has a resolvable resource ID. The body's\n * `memory.resource` is optional so authenticated setups can rely on the\n * server-derived resource ID (MASTRA_RESOURCE_ID_KEY set via mapUserToResourceId).\n * When neither the body nor the request context provides one, reject with a\n * clear 400 instead of failing deep inside agent execution.\n */\nexport function requireEffectiveResourceId(\n  effectiveResourceId: string | undefined,\n): asserts effectiveResourceId is string {\n  if (!effectiveResourceId) {\n    throw new HTTPException(400, {\n      message:\n        'A resource ID is required when using memory. Provide memory.resource in the request body, or configure server auth with mapUserToResourceId to derive it from the authenticated user.',\n    });\n  }\n}\n\n/**\n * Gets the effective threadId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveThreadId(\n  requestContext: RequestContext | undefined,\n  clientThreadId: string | undefined,\n): string | undefined {\n  const contextThreadId = requestContext?.get(MASTRA_THREAD_ID_KEY) as string | undefined;\n  return contextThreadId || clientThreadId;\n}\n\n/**\n * Validates that a thread belongs to the specified resourceId.\n * Throws 403 if the thread exists but belongs to a different resource.\n * Threads with no resourceId are accessible to all (shared threads).\n */\nexport async function validateThreadOwnership(\n  thread: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (thread && effectiveResourceId && thread.resourceId && thread.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: thread belongs to a different resource' });\n  }\n}\n\n/**\n * Validates both coarse resource ownership and fine-grained thread access.\n * FGA enforcement is a no-op when no FGA provider is configured.\n */\nexport async function enforceThreadAccess({\n  mastra,\n  requestContext,\n  threadId,\n  thread,\n  effectiveResourceId,\n  permission = MastraFGAPermissions.MEMORY_READ,\n}: {\n  mastra: any;\n  requestContext?: RequestContext;\n  threadId: string;\n  thread?: { resourceId?: string | null } | null;\n  effectiveResourceId?: string;\n  permission?: MastraFGAPermissionInput;\n}): Promise<void> {\n  await validateThreadOwnership(thread, effectiveResourceId);\n\n  const fgaProvider = mastra?.getServer?.()?.fga;\n  if (!fgaProvider) {\n    return;\n  }\n\n  const user = requestContext?.get('user');\n  if (!user || typeof user !== 'object') {\n    throw new HTTPException(403, { message: 'FGA authorization denied: authenticated user is required' });\n  }\n\n  await MastraMemory.checkThreadFGA({\n    mastra,\n    user: user as { id: string; [key: string]: unknown },\n    threadId,\n    resourceId: thread?.resourceId ?? effectiveResourceId,\n    requestContext,\n    permission,\n  });\n}\n\n/**\n * Validates that a workflow run belongs to the specified resourceId.\n * Throws 403 if the run exists but belongs to a different resource.\n */\nexport async function validateRunOwnership(\n  run: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (run && effectiveResourceId && run.resourceId && run.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: workflow run belongs to a different resource' });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,MAAM,uBAAuB;CAC3B,eAAe;CACf,eAAe;CACf,gBAAgB;CAChB,aAAa;CACb,eAAe;CACf,aAAa;CACb,cAAc;CACd,eAAe;CACf,YAAY;CACZ,uBAAuB;CACvB,wBAAwB;CACxB,mBAAmB;CACnB,gBAAgB;AAClB;AAEA,MAAM,kBAAmB,OAAe;AAQxC,MAAa,uBACX,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,IAAI,kBAAkB;;;ACrDjF,SAAgB,aAAa,MAA+B;CAC1D,MAAM,gBAAgB,OAAO,QAAQ,IAAI,CAAC,CAAC,QAAgC,KAAK,CAAC,KAAK,WAAW;EAC/F,IAAI,CAAC,OACH,IAAI,OAAO,aAAa,IAAI;EAE9B,OAAO;CACT,GAAG,CAAC,CAAC;CAEL,IAAI,OAAO,KAAK,aAAa,CAAC,CAAC,SAAS,GACtC,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,OAAO,OAAO,aAAa,CAAC,CAAC,GAAG,CAAC;AAE7E;;;;;;AAOA,SAAgB,aAAa,MAA+B,gBAA0B;CACpF,KAAK,MAAM,OAAO,gBAChB,IAAI,OAAO,MACT,OAAO,KAAK;AAGlB;AAEA,MAAM,0CAA0B,IAAI,IAAI;CACtC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,SAAgB,6BAA6B,MAA+B;CAC1E,MAAM,gBAAgB,KAAK;CAC3B,IAAI,CAAC,iBAAiB,OAAO,kBAAkB,UAAU;CACzD,MAAM,UAAW,cAAwC;CACzD,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU;CAE7C,MAAM,OAAO,OAAO,YAClB,OAAO,QAAQ,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,wBAAwB,IAAI,KAAK,YAAY,CAAC,CAAC,CAC7F;CACA,KAAK,gBAAgB;EAAE,GAAG;EAAe,SAAS;CAAK;AACzD;AAEA,SAAgB,aACd,OACA,eAAuB,KACvB,MAAc,KACE;CAGhB,KAFoB,SAAS,GAAA,CAAI,KAAK,CAAC,CAAC,YAE3B,MAAM,SACjB,OAAO;CAET,MAAM,SAAS,SAAS,SAAS,OAAO,YAAY,GAAG,EAAE;CACzD,IAAI,MAAM,MAAM,GAAG,OAAO;CAC1B,OAAO,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,MAAM,CAAC;AAC1C;;;;AAKA,SAAgB,aAAa,SAA4E;CACvG,IAAI,CAAC,SAAS,OAAO,KAAA;CAErB,OAAO,OAAO,aACX,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO,EAAA,CAAG,KAAK,SAAiB;EACnE,MAAM,CAAC,KAAK,GAAG,cAAc,KAAK,MAAM,GAAG;EAE3C,OAAO,CAAC,KADM,WAAW,KAAK,GACb,CAAC;CACpB,CAAC,CACH;AACF;;;;;;AAOA,SAAgB,wBAAwB,sBAAsC,oBAAmC;CAC/G,IAAI,CAAC,sBAAsB,OAAO,uBAAuB,UACvD;CAGF,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,kBAAkB,GAAG;EAC7D,IAAI,4BAA4B,GAAG,GAAG;EACtC,IAAI,qBAAqB,IAAI,GAAG,MAAM,KAAA,GACpC,qBAAqB,IAAI,KAAK,KAAK;CAEvC;AACF;;;;;AAUA,SAAgB,uBACd,gBACA,kBACoB;CAEpB,OAD0B,gBAAgB,IAAA,oBAA0B,KACxC;AAC9B;;;;;;;AAQA,SAAgB,qBAAqB,gBAAgE;CACnG,OAAO,gBAAgB,IAAI,sBAAsB;AACnD;;;;;;;;AASA,SAAgB,2BACd,qBACuC;CACvC,IAAI,CAAC,qBACH,MAAM,IAAI,cAAc,KAAK,EAC3B,SACE,wLACJ,CAAC;AAEL;;;;;AAMA,SAAgB,qBACd,gBACA,gBACoB;CAEpB,OADwB,gBAAgB,IAAA,kBAAwB,KACtC;AAC5B;;;;;;AAOA,eAAsB,wBACpB,QACA,qBACe;CACf,IAAI,UAAU,uBAAuB,OAAO,cAAc,OAAO,eAAe,qBAC9E,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,wDAAwD,CAAC;AAErG;;;;;AAMA,eAAsB,oBAAoB,EACxC,QACA,gBACA,UACA,QACA,qBACA,aAAa,qBAAqB,eAQlB;CAChB,MAAM,wBAAwB,QAAQ,mBAAmB;CAGzD,IAAI,CADgB,QAAQ,YAAY,CAAC,EAAE,KAEzC;CAGF,MAAM,OAAO,gBAAgB,IAAI,MAAM;CACvC,IAAI,CAAC,QAAQ,OAAO,SAAS,UAC3B,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,2DAA2D,CAAC;CAGtG,MAAM,aAAa,eAAe;EAChC;EACM;EACN;EACA,YAAY,QAAQ,cAAc;EAClC;EACA;CACF,CAAC;AACH;;;;;AAMA,eAAsB,qBACpB,KACA,qBACe;CACf,IAAI,OAAO,uBAAuB,IAAI,cAAc,IAAI,eAAe,qBACrE,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,8DAA8D,CAAC;AAE3G"}

package/dist/{workflow-builder-DTcM8ER3.cjs → workflow-builder-BSjQJCVD.cjs}

@@ -2,7 +2,7 @@ const require_http_exception = require("./http-exception-CKDHupKw.cjs");
 const require_agents = require("./agents-DwJE1tsB.cjs");
 const require_route_builder = require("./route-builder-2yrD15TL.cjs");
 const require_server_handlers_error = require("./server/handlers/error.cjs");
-const require_utils = require("./utils-aIu3gkhJ.cjs");
+const require_utils = require("./utils-HqDZJwRc.cjs");
 const require_editor_builder = require("./editor-builder-Dm6jviKJ.cjs");
 let zod_v4 = require("zod/v4");
 //#region src/server/schemas/workflow-builder.ts
@@ -112,4 +112,4 @@ Object.defineProperty(exports, "STREAM_WORKFLOW_BUILDER_ROUTE", {
 	}
 });
 
-//# sourceMappingURL=workflow-builder-DTcM8ER3.cjs.map
+//# sourceMappingURL=workflow-builder-BSjQJCVD.cjs.map

package/dist/{workflow-builder-DTcM8ER3.cjs.map → workflow-builder-BSjQJCVD.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"workflow-builder-DTcM8ER3.cjs","names":["z","builderModelPolicySchema","createRoute","handleError","agentExecutionBodySchema","streamResponseSchema","HTTPException","getEffectiveResourceId","getEffectiveThreadId","enforceThreadAccess"],"sources":["../src/server/schemas/workflow-builder.ts","../src/server/handlers/workflow-builder.ts"],"sourcesContent":["import { z } from 'zod/v4';\nimport { builderModelPolicySchema } from './editor-builder';\n\nexport const workflowBuilderSettingsResponseSchema = z.object({\n  enabled: z.boolean(),\n  modelPolicy: builderModelPolicySchema.optional(),\n});\n\nexport type WorkflowBuilderSettingsResponse = z.infer<typeof workflowBuilderSettingsResponseSchema>;\n","import { HTTPException } from '../http-exception';\nimport { agentExecutionBodySchema, streamResponseSchema } from '../schemas/agents';\nimport { workflowBuilderSettingsResponseSchema } from '../schemas/workflow-builder';\nimport { createRoute } from '../server-adapter/routes/route-builder';\nimport { handleError } from './error';\nimport {\n  enforceThreadAccess,\n  getEffectiveResourceId,\n  getEffectiveThreadId,\n  mergeBodyRequestContext,\n  requireEffectiveResourceId,\n  validateBody,\n} from './utils';\n\nexport const GET_WORKFLOW_BUILDER_SETTINGS_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/workflow-builder/settings',\n  responseType: 'json',\n  responseSchema: workflowBuilderSettingsResponseSchema,\n  summary: 'Get persisted workflow builder settings',\n  description: 'Returns whether the editor-owned persisted workflow builder is available',\n  tags: ['Editor'],\n  requiresAuth: true,\n  requiresPermission: 'stored-workflows:read',\n  handler: async ({ mastra }) => {\n    try {\n      const editor = mastra.getEditor();\n      if (!editor || typeof editor.resolveWorkflowBuilder !== 'function') return { enabled: false };\n      if (!editor.hasEnabledWorkflowBuilderConfig?.()) return { enabled: false };\n\n      const builder = await editor.resolveWorkflowBuilder();\n      return {\n        enabled: builder?.enabled === true,\n        modelPolicy: builder?.getModelPolicy(),\n      };\n    } catch (error) {\n      return handleError(error, 'Error getting workflow builder settings');\n    }\n  },\n});\n\nexport const STREAM_WORKFLOW_BUILDER_ROUTE = createRoute({\n  method: 'POST',\n  path: '/editor/workflow-builder/stream',\n  responseType: 'stream' as const,\n  streamFormat: 'sse' as const,\n  bodySchema: agentExecutionBodySchema,\n  responseSchema: streamResponseSchema,\n  summary: 'Stream persisted workflow builder response',\n  description: 'Streams from the hidden editor-owned workflow builder agent',\n  tags: ['Editor'],\n  requiresAuth: true,\n  requiresPermission: 'stored-workflows:write',\n  handler: async ({ mastra, abortSignal, requestContext: serverRequestContext, ...params }) => {\n    try {\n      const editor = mastra.getEditor();\n      if (!editor?.hasEnabledWorkflowBuilderConfig?.() || typeof editor.resolveWorkflowBuilder !== 'function') {\n        throw new HTTPException(404, { message: 'Workflow builder is not enabled' });\n      }\n\n      const builder = await editor.resolveWorkflowBuilder();\n      if (!builder?.enabled) throw new HTTPException(404, { message: 'Workflow builder is not enabled' });\n      const agent = builder.getAgent();\n\n      const { messages, memory: memoryOption, requestContext: bodyRequestContext, ...rest } = params;\n      validateBody({ messages });\n\n      mergeBodyRequestContext(serverRequestContext, bodyRequestContext);\n\n      let authorizedMemoryOption = memoryOption;\n      if (memoryOption) {\n        const clientThreadId = typeof memoryOption.thread === 'string' ? memoryOption.thread : memoryOption.thread?.id;\n        const effectiveResourceId = getEffectiveResourceId(serverRequestContext, memoryOption.resource);\n        requireEffectiveResourceId(effectiveResourceId);\n        const effectiveThreadId = getEffectiveThreadId(serverRequestContext, clientThreadId);\n\n        if (effectiveThreadId) {\n          const memory = await agent.getMemory({ requestContext: serverRequestContext });\n          const thread = await memory?.getThreadById({ threadId: effectiveThreadId });\n          if (thread) {\n            await enforceThreadAccess({\n              mastra,\n              requestContext: serverRequestContext,\n              threadId: effectiveThreadId,\n              thread,\n              effectiveResourceId,\n              permission: 'memory:write',\n            });\n          }\n        }\n\n        authorizedMemoryOption = {\n          ...memoryOption,\n          resource: effectiveResourceId ?? memoryOption.resource,\n          thread: effectiveThreadId ?? memoryOption.thread,\n        };\n      }\n\n      const { structuredOutput, ...streamOptions } = rest;\n      const options: Record<string, any> = {\n        ...streamOptions,\n        requestContext: serverRequestContext,\n        memory: authorizedMemoryOption,\n        abortSignal,\n      };\n      const result = structuredOutput\n        ? await agent.stream(messages, { ...options, structuredOutput })\n        : await agent.stream(messages, options);\n      return result.fullStream;\n    } catch (error) {\n      return handleError(error, 'Error streaming workflow builder response');\n    }\n  },\n});\n"],"mappings":";;;;;;;;AAGA,MAAa,wCAAwCA,OAAAA,EAAE,OAAO;CAC5D,SAASA,OAAAA,EAAE,QAAQ;CACnB,aAAaC,uBAAAA,yBAAyB,SAAS;AACjD,CAAC;;;ACQD,MAAa,sCAAsCC,sBAAAA,YAAY;CAC7D,QAAQ;CACR,MAAM;CACN,cAAc;CACd,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,QAAQ;CACf,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,aAAa;EAC7B,IAAI;GACF,MAAM,SAAS,OAAO,UAAU;GAChC,IAAI,CAAC,UAAU,OAAO,OAAO,2BAA2B,YAAY,OAAO,EAAE,SAAS,MAAM;GAC5F,IAAI,CAAC,OAAO,kCAAkC,GAAG,OAAO,EAAE,SAAS,MAAM;GAEzE,MAAM,UAAU,MAAM,OAAO,uBAAuB;GACpD,OAAO;IACL,SAAS,SAAS,YAAY;IAC9B,aAAa,SAAS,eAAe;GACvC;EACF,SAAS,OAAO;GACd,OAAOC,8BAAAA,YAAY,OAAO,yCAAyC;EACrE;CACF;AACF,CAAC;AAED,MAAa,gCAAgCD,sBAAAA,YAAY;CACvD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,cAAc;CACd,YAAYE,eAAAA;CACZ,gBAAgBC,eAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,QAAQ;CACf,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,aAAa,gBAAgB,sBAAsB,GAAG,aAAa;EAC3F,IAAI;GACF,MAAM,SAAS,OAAO,UAAU;GAChC,IAAI,CAAC,QAAQ,kCAAkC,KAAK,OAAO,OAAO,2BAA2B,YAC3F,MAAM,IAAIC,uBAAAA,cAAc,KAAK,EAAE,SAAS,kCAAkC,CAAC;GAG7E,MAAM,UAAU,MAAM,OAAO,uBAAuB;GACpD,IAAI,CAAC,SAAS,SAAS,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,kCAAkC,CAAC;GAClG,MAAM,QAAQ,QAAQ,SAAS;GAE/B,MAAM,EAAE,UAAU,QAAQ,cAAc,gBAAgB,oBAAoB,GAAG,SAAS;GACxF,cAAA,aAAa,EAAE,SAAS,CAAC;GAEzB,cAAA,wBAAwB,sBAAsB,kBAAkB;GAEhE,IAAI,yBAAyB;GAC7B,IAAI,cAAc;IAChB,MAAM,iBAAiB,OAAO,aAAa,WAAW,WAAW,aAAa,SAAS,aAAa,QAAQ;IAC5G,MAAM,sBAAsBC,cAAAA,uBAAuB,sBAAsB,aAAa,QAAQ;IAC9F,cAAA,2BAA2B,mBAAmB;IAC9C,MAAM,oBAAoBC,cAAAA,qBAAqB,sBAAsB,cAAc;IAEnF,IAAI,mBAAmB;KAErB,MAAM,SAAS,OAAM,MADA,MAAM,UAAU,EAAE,gBAAgB,qBAAqB,CAAC,EAAA,EAChD,cAAc,EAAE,UAAU,kBAAkB,CAAC;KAC1E,IAAI,QACF,MAAMC,cAAAA,oBAAoB;MACxB;MACA,gBAAgB;MAChB,UAAU;MACV;MACA;MACA,YAAY;KACd,CAAC;IAEL;IAEA,yBAAyB;KACvB,GAAG;KACH,UAAU,uBAAuB,aAAa;KAC9C,QAAQ,qBAAqB,aAAa;IAC5C;GACF;GAEA,MAAM,EAAE,kBAAkB,GAAG,kBAAkB;GAC/C,MAAM,UAA+B;IACnC,GAAG;IACH,gBAAgB;IAChB,QAAQ;IACR;GACF;GAIA,QAHe,mBACX,MAAM,MAAM,OAAO,UAAU;IAAE,GAAG;IAAS;GAAiB,CAAC,IAC7D,MAAM,MAAM,OAAO,UAAU,OAAO,EAAA,CAC1B;EAChB,SAAS,OAAO;GACd,OAAON,8BAAAA,YAAY,OAAO,2CAA2C;EACvE;CACF;AACF,CAAC"}
+{"version":3,"file":"workflow-builder-BSjQJCVD.cjs","names":["z","builderModelPolicySchema","createRoute","handleError","agentExecutionBodySchema","streamResponseSchema","HTTPException","getEffectiveResourceId","getEffectiveThreadId","enforceThreadAccess"],"sources":["../src/server/schemas/workflow-builder.ts","../src/server/handlers/workflow-builder.ts"],"sourcesContent":["import { z } from 'zod/v4';\nimport { builderModelPolicySchema } from './editor-builder';\n\nexport const workflowBuilderSettingsResponseSchema = z.object({\n  enabled: z.boolean(),\n  modelPolicy: builderModelPolicySchema.optional(),\n});\n\nexport type WorkflowBuilderSettingsResponse = z.infer<typeof workflowBuilderSettingsResponseSchema>;\n","import { HTTPException } from '../http-exception';\nimport { agentExecutionBodySchema, streamResponseSchema } from '../schemas/agents';\nimport { workflowBuilderSettingsResponseSchema } from '../schemas/workflow-builder';\nimport { createRoute } from '../server-adapter/routes/route-builder';\nimport { handleError } from './error';\nimport {\n  enforceThreadAccess,\n  getEffectiveResourceId,\n  getEffectiveThreadId,\n  mergeBodyRequestContext,\n  requireEffectiveResourceId,\n  validateBody,\n} from './utils';\n\nexport const GET_WORKFLOW_BUILDER_SETTINGS_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/workflow-builder/settings',\n  responseType: 'json',\n  responseSchema: workflowBuilderSettingsResponseSchema,\n  summary: 'Get persisted workflow builder settings',\n  description: 'Returns whether the editor-owned persisted workflow builder is available',\n  tags: ['Editor'],\n  requiresAuth: true,\n  requiresPermission: 'stored-workflows:read',\n  handler: async ({ mastra }) => {\n    try {\n      const editor = mastra.getEditor();\n      if (!editor || typeof editor.resolveWorkflowBuilder !== 'function') return { enabled: false };\n      if (!editor.hasEnabledWorkflowBuilderConfig?.()) return { enabled: false };\n\n      const builder = await editor.resolveWorkflowBuilder();\n      return {\n        enabled: builder?.enabled === true,\n        modelPolicy: builder?.getModelPolicy(),\n      };\n    } catch (error) {\n      return handleError(error, 'Error getting workflow builder settings');\n    }\n  },\n});\n\nexport const STREAM_WORKFLOW_BUILDER_ROUTE = createRoute({\n  method: 'POST',\n  path: '/editor/workflow-builder/stream',\n  responseType: 'stream' as const,\n  streamFormat: 'sse' as const,\n  bodySchema: agentExecutionBodySchema,\n  responseSchema: streamResponseSchema,\n  summary: 'Stream persisted workflow builder response',\n  description: 'Streams from the hidden editor-owned workflow builder agent',\n  tags: ['Editor'],\n  requiresAuth: true,\n  requiresPermission: 'stored-workflows:write',\n  handler: async ({ mastra, abortSignal, requestContext: serverRequestContext, ...params }) => {\n    try {\n      const editor = mastra.getEditor();\n      if (!editor?.hasEnabledWorkflowBuilderConfig?.() || typeof editor.resolveWorkflowBuilder !== 'function') {\n        throw new HTTPException(404, { message: 'Workflow builder is not enabled' });\n      }\n\n      const builder = await editor.resolveWorkflowBuilder();\n      if (!builder?.enabled) throw new HTTPException(404, { message: 'Workflow builder is not enabled' });\n      const agent = builder.getAgent();\n\n      const { messages, memory: memoryOption, requestContext: bodyRequestContext, ...rest } = params;\n      validateBody({ messages });\n\n      mergeBodyRequestContext(serverRequestContext, bodyRequestContext);\n\n      let authorizedMemoryOption = memoryOption;\n      if (memoryOption) {\n        const clientThreadId = typeof memoryOption.thread === 'string' ? memoryOption.thread : memoryOption.thread?.id;\n        const effectiveResourceId = getEffectiveResourceId(serverRequestContext, memoryOption.resource);\n        requireEffectiveResourceId(effectiveResourceId);\n        const effectiveThreadId = getEffectiveThreadId(serverRequestContext, clientThreadId);\n\n        if (effectiveThreadId) {\n          const memory = await agent.getMemory({ requestContext: serverRequestContext });\n          const thread = await memory?.getThreadById({ threadId: effectiveThreadId });\n          if (thread) {\n            await enforceThreadAccess({\n              mastra,\n              requestContext: serverRequestContext,\n              threadId: effectiveThreadId,\n              thread,\n              effectiveResourceId,\n              permission: 'memory:write',\n            });\n          }\n        }\n\n        authorizedMemoryOption = {\n          ...memoryOption,\n          resource: effectiveResourceId ?? memoryOption.resource,\n          thread: effectiveThreadId ?? memoryOption.thread,\n        };\n      }\n\n      const { structuredOutput, ...streamOptions } = rest;\n      const options: Record<string, any> = {\n        ...streamOptions,\n        requestContext: serverRequestContext,\n        memory: authorizedMemoryOption,\n        abortSignal,\n      };\n      const result = structuredOutput\n        ? await agent.stream(messages, { ...options, structuredOutput })\n        : await agent.stream(messages, options);\n      return result.fullStream;\n    } catch (error) {\n      return handleError(error, 'Error streaming workflow builder response');\n    }\n  },\n});\n"],"mappings":";;;;;;;;AAGA,MAAa,wCAAwCA,OAAAA,EAAE,OAAO;CAC5D,SAASA,OAAAA,EAAE,QAAQ;CACnB,aAAaC,uBAAAA,yBAAyB,SAAS;AACjD,CAAC;;;ACQD,MAAa,sCAAsCC,sBAAAA,YAAY;CAC7D,QAAQ;CACR,MAAM;CACN,cAAc;CACd,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,QAAQ;CACf,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,aAAa;EAC7B,IAAI;GACF,MAAM,SAAS,OAAO,UAAU;GAChC,IAAI,CAAC,UAAU,OAAO,OAAO,2BAA2B,YAAY,OAAO,EAAE,SAAS,MAAM;GAC5F,IAAI,CAAC,OAAO,kCAAkC,GAAG,OAAO,EAAE,SAAS,MAAM;GAEzE,MAAM,UAAU,MAAM,OAAO,uBAAuB;GACpD,OAAO;IACL,SAAS,SAAS,YAAY;IAC9B,aAAa,SAAS,eAAe;GACvC;EACF,SAAS,OAAO;GACd,OAAOC,8BAAAA,YAAY,OAAO,yCAAyC;EACrE;CACF;AACF,CAAC;AAED,MAAa,gCAAgCD,sBAAAA,YAAY;CACvD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,cAAc;CACd,YAAYE,eAAAA;CACZ,gBAAgBC,eAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,QAAQ;CACf,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,aAAa,gBAAgB,sBAAsB,GAAG,aAAa;EAC3F,IAAI;GACF,MAAM,SAAS,OAAO,UAAU;GAChC,IAAI,CAAC,QAAQ,kCAAkC,KAAK,OAAO,OAAO,2BAA2B,YAC3F,MAAM,IAAIC,uBAAAA,cAAc,KAAK,EAAE,SAAS,kCAAkC,CAAC;GAG7E,MAAM,UAAU,MAAM,OAAO,uBAAuB;GACpD,IAAI,CAAC,SAAS,SAAS,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,kCAAkC,CAAC;GAClG,MAAM,QAAQ,QAAQ,SAAS;GAE/B,MAAM,EAAE,UAAU,QAAQ,cAAc,gBAAgB,oBAAoB,GAAG,SAAS;GACxF,cAAA,aAAa,EAAE,SAAS,CAAC;GAEzB,cAAA,wBAAwB,sBAAsB,kBAAkB;GAEhE,IAAI,yBAAyB;GAC7B,IAAI,cAAc;IAChB,MAAM,iBAAiB,OAAO,aAAa,WAAW,WAAW,aAAa,SAAS,aAAa,QAAQ;IAC5G,MAAM,sBAAsBC,cAAAA,uBAAuB,sBAAsB,aAAa,QAAQ;IAC9F,cAAA,2BAA2B,mBAAmB;IAC9C,MAAM,oBAAoBC,cAAAA,qBAAqB,sBAAsB,cAAc;IAEnF,IAAI,mBAAmB;KAErB,MAAM,SAAS,OAAM,MADA,MAAM,UAAU,EAAE,gBAAgB,qBAAqB,CAAC,EAAA,EAChD,cAAc,EAAE,UAAU,kBAAkB,CAAC;KAC1E,IAAI,QACF,MAAMC,cAAAA,oBAAoB;MACxB;MACA,gBAAgB;MAChB,UAAU;MACV;MACA;MACA,YAAY;KACd,CAAC;IAEL;IAEA,yBAAyB;KACvB,GAAG;KACH,UAAU,uBAAuB,aAAa;KAC9C,QAAQ,qBAAqB,aAAa;IAC5C;GACF;GAEA,MAAM,EAAE,kBAAkB,GAAG,kBAAkB;GAC/C,MAAM,UAA+B;IACnC,GAAG;IACH,gBAAgB;IAChB,QAAQ;IACR;GACF;GAIA,QAHe,mBACX,MAAM,MAAM,OAAO,UAAU;IAAE,GAAG;IAAS;GAAiB,CAAC,IAC7D,MAAM,MAAM,OAAO,UAAU,OAAO,EAAA,CAC1B;EAChB,SAAS,OAAO;GACd,OAAON,8BAAAA,YAAY,OAAO,2CAA2C;EACvE;CACF;AACF,CAAC"}

package/dist/{workflow-builder-KRSpDol2.js → workflow-builder-DJ48IzXQ.js}

@@ -2,7 +2,7 @@ import { t as HTTPException } from "./http-exception-CyfxZB6W.js";
 import { J as streamResponseSchema, r as agentExecutionBodySchema } from "./agents-kOz1lr_e.js";
 import { n as createRoute } from "./route-builder-lBil8Cvo.js";
 import { handleError } from "./server/handlers/error.js";
-import { a as mergeBodyRequestContext, c as requireEffectiveResourceId, i as getEffectiveThreadId, r as getEffectiveResourceId, t as enforceThreadAccess, u as validateBody } from "./utils-KsERfbhc.js";
+import { a as mergeBodyRequestContext, c as requireEffectiveResourceId, d as validateBody, i as getEffectiveThreadId, r as getEffectiveResourceId, t as enforceThreadAccess } from "./utils-KcHk7C0D.js";
 import { a as builderModelPolicySchema } from "./editor-builder-BLi1jvZd.js";
 import { z } from "zod/v4";
 //#endregion
@@ -99,4 +99,4 @@ const STREAM_WORKFLOW_BUILDER_ROUTE = createRoute({
 //#endregion
 export { STREAM_WORKFLOW_BUILDER_ROUTE as n, GET_WORKFLOW_BUILDER_SETTINGS_ROUTE as t };
 
-//# sourceMappingURL=workflow-builder-KRSpDol2.js.map
+//# sourceMappingURL=workflow-builder-DJ48IzXQ.js.map

package/dist/{workflow-builder-KRSpDol2.js.map → workflow-builder-DJ48IzXQ.js.map}

@@ -1 +1 @@
-{"version":3,"file":"workflow-builder-KRSpDol2.js","names":[],"sources":["../src/server/schemas/workflow-builder.ts","../src/server/handlers/workflow-builder.ts"],"sourcesContent":["import { z } from 'zod/v4';\nimport { builderModelPolicySchema } from './editor-builder';\n\nexport const workflowBuilderSettingsResponseSchema = z.object({\n  enabled: z.boolean(),\n  modelPolicy: builderModelPolicySchema.optional(),\n});\n\nexport type WorkflowBuilderSettingsResponse = z.infer<typeof workflowBuilderSettingsResponseSchema>;\n","import { HTTPException } from '../http-exception';\nimport { agentExecutionBodySchema, streamResponseSchema } from '../schemas/agents';\nimport { workflowBuilderSettingsResponseSchema } from '../schemas/workflow-builder';\nimport { createRoute } from '../server-adapter/routes/route-builder';\nimport { handleError } from './error';\nimport {\n  enforceThreadAccess,\n  getEffectiveResourceId,\n  getEffectiveThreadId,\n  mergeBodyRequestContext,\n  requireEffectiveResourceId,\n  validateBody,\n} from './utils';\n\nexport const GET_WORKFLOW_BUILDER_SETTINGS_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/workflow-builder/settings',\n  responseType: 'json',\n  responseSchema: workflowBuilderSettingsResponseSchema,\n  summary: 'Get persisted workflow builder settings',\n  description: 'Returns whether the editor-owned persisted workflow builder is available',\n  tags: ['Editor'],\n  requiresAuth: true,\n  requiresPermission: 'stored-workflows:read',\n  handler: async ({ mastra }) => {\n    try {\n      const editor = mastra.getEditor();\n      if (!editor || typeof editor.resolveWorkflowBuilder !== 'function') return { enabled: false };\n      if (!editor.hasEnabledWorkflowBuilderConfig?.()) return { enabled: false };\n\n      const builder = await editor.resolveWorkflowBuilder();\n      return {\n        enabled: builder?.enabled === true,\n        modelPolicy: builder?.getModelPolicy(),\n      };\n    } catch (error) {\n      return handleError(error, 'Error getting workflow builder settings');\n    }\n  },\n});\n\nexport const STREAM_WORKFLOW_BUILDER_ROUTE = createRoute({\n  method: 'POST',\n  path: '/editor/workflow-builder/stream',\n  responseType: 'stream' as const,\n  streamFormat: 'sse' as const,\n  bodySchema: agentExecutionBodySchema,\n  responseSchema: streamResponseSchema,\n  summary: 'Stream persisted workflow builder response',\n  description: 'Streams from the hidden editor-owned workflow builder agent',\n  tags: ['Editor'],\n  requiresAuth: true,\n  requiresPermission: 'stored-workflows:write',\n  handler: async ({ mastra, abortSignal, requestContext: serverRequestContext, ...params }) => {\n    try {\n      const editor = mastra.getEditor();\n      if (!editor?.hasEnabledWorkflowBuilderConfig?.() || typeof editor.resolveWorkflowBuilder !== 'function') {\n        throw new HTTPException(404, { message: 'Workflow builder is not enabled' });\n      }\n\n      const builder = await editor.resolveWorkflowBuilder();\n      if (!builder?.enabled) throw new HTTPException(404, { message: 'Workflow builder is not enabled' });\n      const agent = builder.getAgent();\n\n      const { messages, memory: memoryOption, requestContext: bodyRequestContext, ...rest } = params;\n      validateBody({ messages });\n\n      mergeBodyRequestContext(serverRequestContext, bodyRequestContext);\n\n      let authorizedMemoryOption = memoryOption;\n      if (memoryOption) {\n        const clientThreadId = typeof memoryOption.thread === 'string' ? memoryOption.thread : memoryOption.thread?.id;\n        const effectiveResourceId = getEffectiveResourceId(serverRequestContext, memoryOption.resource);\n        requireEffectiveResourceId(effectiveResourceId);\n        const effectiveThreadId = getEffectiveThreadId(serverRequestContext, clientThreadId);\n\n        if (effectiveThreadId) {\n          const memory = await agent.getMemory({ requestContext: serverRequestContext });\n          const thread = await memory?.getThreadById({ threadId: effectiveThreadId });\n          if (thread) {\n            await enforceThreadAccess({\n              mastra,\n              requestContext: serverRequestContext,\n              threadId: effectiveThreadId,\n              thread,\n              effectiveResourceId,\n              permission: 'memory:write',\n            });\n          }\n        }\n\n        authorizedMemoryOption = {\n          ...memoryOption,\n          resource: effectiveResourceId ?? memoryOption.resource,\n          thread: effectiveThreadId ?? memoryOption.thread,\n        };\n      }\n\n      const { structuredOutput, ...streamOptions } = rest;\n      const options: Record<string, any> = {\n        ...streamOptions,\n        requestContext: serverRequestContext,\n        memory: authorizedMemoryOption,\n        abortSignal,\n      };\n      const result = structuredOutput\n        ? await agent.stream(messages, { ...options, structuredOutput })\n        : await agent.stream(messages, options);\n      return result.fullStream;\n    } catch (error) {\n      return handleError(error, 'Error streaming workflow builder response');\n    }\n  },\n});\n"],"mappings":";;;;;;;;;ACcA,MAAa,sCAAsC,YAAY;CAC7D,QAAQ;CACR,MAAM;CACN,cAAc;CACd,gBDfmD,EAAE,OAAO;EAC5D,SAAS,EAAE,QAAQ;EACnB,aAAa,yBAAyB,SAAS;CACjD,CCYkB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,QAAQ;CACf,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,aAAa;EAC7B,IAAI;GACF,MAAM,SAAS,OAAO,UAAU;GAChC,IAAI,CAAC,UAAU,OAAO,OAAO,2BAA2B,YAAY,OAAO,EAAE,SAAS,MAAM;GAC5F,IAAI,CAAC,OAAO,kCAAkC,GAAG,OAAO,EAAE,SAAS,MAAM;GAEzE,MAAM,UAAU,MAAM,OAAO,uBAAuB;GACpD,OAAO;IACL,SAAS,SAAS,YAAY;IAC9B,aAAa,SAAS,eAAe;GACvC;EACF,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,yCAAyC;EACrE;CACF;AACF,CAAC;AAED,MAAa,gCAAgC,YAAY;CACvD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,cAAc;CACd,YAAY;CACZ,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,QAAQ;CACf,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,aAAa,gBAAgB,sBAAsB,GAAG,aAAa;EAC3F,IAAI;GACF,MAAM,SAAS,OAAO,UAAU;GAChC,IAAI,CAAC,QAAQ,kCAAkC,KAAK,OAAO,OAAO,2BAA2B,YAC3F,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,kCAAkC,CAAC;GAG7E,MAAM,UAAU,MAAM,OAAO,uBAAuB;GACpD,IAAI,CAAC,SAAS,SAAS,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,kCAAkC,CAAC;GAClG,MAAM,QAAQ,QAAQ,SAAS;GAE/B,MAAM,EAAE,UAAU,QAAQ,cAAc,gBAAgB,oBAAoB,GAAG,SAAS;GACxF,aAAa,EAAE,SAAS,CAAC;GAEzB,wBAAwB,sBAAsB,kBAAkB;GAEhE,IAAI,yBAAyB;GAC7B,IAAI,cAAc;IAChB,MAAM,iBAAiB,OAAO,aAAa,WAAW,WAAW,aAAa,SAAS,aAAa,QAAQ;IAC5G,MAAM,sBAAsB,uBAAuB,sBAAsB,aAAa,QAAQ;IAC9F,2BAA2B,mBAAmB;IAC9C,MAAM,oBAAoB,qBAAqB,sBAAsB,cAAc;IAEnF,IAAI,mBAAmB;KAErB,MAAM,SAAS,OAAM,MADA,MAAM,UAAU,EAAE,gBAAgB,qBAAqB,CAAC,EAAA,EAChD,cAAc,EAAE,UAAU,kBAAkB,CAAC;KAC1E,IAAI,QACF,MAAM,oBAAoB;MACxB;MACA,gBAAgB;MAChB,UAAU;MACV;MACA;MACA,YAAY;KACd,CAAC;IAEL;IAEA,yBAAyB;KACvB,GAAG;KACH,UAAU,uBAAuB,aAAa;KAC9C,QAAQ,qBAAqB,aAAa;IAC5C;GACF;GAEA,MAAM,EAAE,kBAAkB,GAAG,kBAAkB;GAC/C,MAAM,UAA+B;IACnC,GAAG;IACH,gBAAgB;IAChB,QAAQ;IACR;GACF;GAIA,QAHe,mBACX,MAAM,MAAM,OAAO,UAAU;IAAE,GAAG;IAAS;GAAiB,CAAC,IAC7D,MAAM,MAAM,OAAO,UAAU,OAAO,EAAA,CAC1B;EAChB,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,2CAA2C;EACvE;CACF;AACF,CAAC"}
+{"version":3,"file":"workflow-builder-DJ48IzXQ.js","names":[],"sources":["../src/server/schemas/workflow-builder.ts","../src/server/handlers/workflow-builder.ts"],"sourcesContent":["import { z } from 'zod/v4';\nimport { builderModelPolicySchema } from './editor-builder';\n\nexport const workflowBuilderSettingsResponseSchema = z.object({\n  enabled: z.boolean(),\n  modelPolicy: builderModelPolicySchema.optional(),\n});\n\nexport type WorkflowBuilderSettingsResponse = z.infer<typeof workflowBuilderSettingsResponseSchema>;\n","import { HTTPException } from '../http-exception';\nimport { agentExecutionBodySchema, streamResponseSchema } from '../schemas/agents';\nimport { workflowBuilderSettingsResponseSchema } from '../schemas/workflow-builder';\nimport { createRoute } from '../server-adapter/routes/route-builder';\nimport { handleError } from './error';\nimport {\n  enforceThreadAccess,\n  getEffectiveResourceId,\n  getEffectiveThreadId,\n  mergeBodyRequestContext,\n  requireEffectiveResourceId,\n  validateBody,\n} from './utils';\n\nexport const GET_WORKFLOW_BUILDER_SETTINGS_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/workflow-builder/settings',\n  responseType: 'json',\n  responseSchema: workflowBuilderSettingsResponseSchema,\n  summary: 'Get persisted workflow builder settings',\n  description: 'Returns whether the editor-owned persisted workflow builder is available',\n  tags: ['Editor'],\n  requiresAuth: true,\n  requiresPermission: 'stored-workflows:read',\n  handler: async ({ mastra }) => {\n    try {\n      const editor = mastra.getEditor();\n      if (!editor || typeof editor.resolveWorkflowBuilder !== 'function') return { enabled: false };\n      if (!editor.hasEnabledWorkflowBuilderConfig?.()) return { enabled: false };\n\n      const builder = await editor.resolveWorkflowBuilder();\n      return {\n        enabled: builder?.enabled === true,\n        modelPolicy: builder?.getModelPolicy(),\n      };\n    } catch (error) {\n      return handleError(error, 'Error getting workflow builder settings');\n    }\n  },\n});\n\nexport const STREAM_WORKFLOW_BUILDER_ROUTE = createRoute({\n  method: 'POST',\n  path: '/editor/workflow-builder/stream',\n  responseType: 'stream' as const,\n  streamFormat: 'sse' as const,\n  bodySchema: agentExecutionBodySchema,\n  responseSchema: streamResponseSchema,\n  summary: 'Stream persisted workflow builder response',\n  description: 'Streams from the hidden editor-owned workflow builder agent',\n  tags: ['Editor'],\n  requiresAuth: true,\n  requiresPermission: 'stored-workflows:write',\n  handler: async ({ mastra, abortSignal, requestContext: serverRequestContext, ...params }) => {\n    try {\n      const editor = mastra.getEditor();\n      if (!editor?.hasEnabledWorkflowBuilderConfig?.() || typeof editor.resolveWorkflowBuilder !== 'function') {\n        throw new HTTPException(404, { message: 'Workflow builder is not enabled' });\n      }\n\n      const builder = await editor.resolveWorkflowBuilder();\n      if (!builder?.enabled) throw new HTTPException(404, { message: 'Workflow builder is not enabled' });\n      const agent = builder.getAgent();\n\n      const { messages, memory: memoryOption, requestContext: bodyRequestContext, ...rest } = params;\n      validateBody({ messages });\n\n      mergeBodyRequestContext(serverRequestContext, bodyRequestContext);\n\n      let authorizedMemoryOption = memoryOption;\n      if (memoryOption) {\n        const clientThreadId = typeof memoryOption.thread === 'string' ? memoryOption.thread : memoryOption.thread?.id;\n        const effectiveResourceId = getEffectiveResourceId(serverRequestContext, memoryOption.resource);\n        requireEffectiveResourceId(effectiveResourceId);\n        const effectiveThreadId = getEffectiveThreadId(serverRequestContext, clientThreadId);\n\n        if (effectiveThreadId) {\n          const memory = await agent.getMemory({ requestContext: serverRequestContext });\n          const thread = await memory?.getThreadById({ threadId: effectiveThreadId });\n          if (thread) {\n            await enforceThreadAccess({\n              mastra,\n              requestContext: serverRequestContext,\n              threadId: effectiveThreadId,\n              thread,\n              effectiveResourceId,\n              permission: 'memory:write',\n            });\n          }\n        }\n\n        authorizedMemoryOption = {\n          ...memoryOption,\n          resource: effectiveResourceId ?? memoryOption.resource,\n          thread: effectiveThreadId ?? memoryOption.thread,\n        };\n      }\n\n      const { structuredOutput, ...streamOptions } = rest;\n      const options: Record<string, any> = {\n        ...streamOptions,\n        requestContext: serverRequestContext,\n        memory: authorizedMemoryOption,\n        abortSignal,\n      };\n      const result = structuredOutput\n        ? await agent.stream(messages, { ...options, structuredOutput })\n        : await agent.stream(messages, options);\n      return result.fullStream;\n    } catch (error) {\n      return handleError(error, 'Error streaming workflow builder response');\n    }\n  },\n});\n"],"mappings":";;;;;;;;;ACcA,MAAa,sCAAsC,YAAY;CAC7D,QAAQ;CACR,MAAM;CACN,cAAc;CACd,gBDfmD,EAAE,OAAO;EAC5D,SAAS,EAAE,QAAQ;EACnB,aAAa,yBAAyB,SAAS;CACjD,CCYkB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,QAAQ;CACf,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,aAAa;EAC7B,IAAI;GACF,MAAM,SAAS,OAAO,UAAU;GAChC,IAAI,CAAC,UAAU,OAAO,OAAO,2BAA2B,YAAY,OAAO,EAAE,SAAS,MAAM;GAC5F,IAAI,CAAC,OAAO,kCAAkC,GAAG,OAAO,EAAE,SAAS,MAAM;GAEzE,MAAM,UAAU,MAAM,OAAO,uBAAuB;GACpD,OAAO;IACL,SAAS,SAAS,YAAY;IAC9B,aAAa,SAAS,eAAe;GACvC;EACF,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,yCAAyC;EACrE;CACF;AACF,CAAC;AAED,MAAa,gCAAgC,YAAY;CACvD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,cAAc;CACd,YAAY;CACZ,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,QAAQ;CACf,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,aAAa,gBAAgB,sBAAsB,GAAG,aAAa;EAC3F,IAAI;GACF,MAAM,SAAS,OAAO,UAAU;GAChC,IAAI,CAAC,QAAQ,kCAAkC,KAAK,OAAO,OAAO,2BAA2B,YAC3F,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,kCAAkC,CAAC;GAG7E,MAAM,UAAU,MAAM,OAAO,uBAAuB;GACpD,IAAI,CAAC,SAAS,SAAS,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,kCAAkC,CAAC;GAClG,MAAM,QAAQ,QAAQ,SAAS;GAE/B,MAAM,EAAE,UAAU,QAAQ,cAAc,gBAAgB,oBAAoB,GAAG,SAAS;GACxF,aAAa,EAAE,SAAS,CAAC;GAEzB,wBAAwB,sBAAsB,kBAAkB;GAEhE,IAAI,yBAAyB;GAC7B,IAAI,cAAc;IAChB,MAAM,iBAAiB,OAAO,aAAa,WAAW,WAAW,aAAa,SAAS,aAAa,QAAQ;IAC5G,MAAM,sBAAsB,uBAAuB,sBAAsB,aAAa,QAAQ;IAC9F,2BAA2B,mBAAmB;IAC9C,MAAM,oBAAoB,qBAAqB,sBAAsB,cAAc;IAEnF,IAAI,mBAAmB;KAErB,MAAM,SAAS,OAAM,MADA,MAAM,UAAU,EAAE,gBAAgB,qBAAqB,CAAC,EAAA,EAChD,cAAc,EAAE,UAAU,kBAAkB,CAAC;KAC1E,IAAI,QACF,MAAM,oBAAoB;MACxB;MACA,gBAAgB;MAChB,UAAU;MACV;MACA;MACA,YAAY;KACd,CAAC;IAEL;IAEA,yBAAyB;KACvB,GAAG;KACH,UAAU,uBAAuB,aAAa;KAC9C,QAAQ,qBAAqB,aAAa;IAC5C;GACF;GAEA,MAAM,EAAE,kBAAkB,GAAG,kBAAkB;GAC/C,MAAM,UAA+B;IACnC,GAAG;IACH,gBAAgB;IAChB,QAAQ;IACR;GACF;GAIA,QAHe,mBACX,MAAM,MAAM,OAAO,UAAU;IAAE,GAAG;IAAS;GAAiB,CAAC,IAC7D,MAAM,MAAM,OAAO,UAAU,OAAO,EAAA,CAC1B;EAChB,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,2CAA2C;EACvE;CACF;AACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mastra/server",
-  "version": "1.75.0-alpha.0",
+  "version": "1.75.0-alpha.1",
   "description": "",
   "type": "module",
   "files": [
@@ -117,14 +117,14 @@
     "zod": "^4.6.4",
     "zod-to-ts": "^2.1.0",
     "@internal/core": "0.1.2",
-    "@internal/storage-test-utils": "0.0.136",
     "@internal/lint": "0.0.140",
+    "@internal/storage-test-utils": "0.0.136",
     "@internal/types-builder": "0.0.115",
-    "@mastra/agent-builder": "1.1.26-alpha.0",
-    "@internal/test-utils": "0.0.76",
     "@internal/voice": "0.0.38",
-    "@mastra/core": "1.75.0-alpha.0",
-    "@mastra/schema-compat": "1.3.13"
+    "@mastra/agent-builder": "1.1.26-alpha.1",
+    "@mastra/schema-compat": "1.3.13",
+    "@internal/test-utils": "0.0.76",
+    "@mastra/core": "1.75.0-alpha.1"
   },
   "homepage": "https://mastra.ai",
   "repository": {