@mastra/server 1.77.0-alpha.4 → 1.78.0-alpha.0

package/dist/server/handlers/agents.js

@@ -4,10 +4,10 @@ import { $ as updateAgentModelBodySchema, A as observeAgentResponseSchema, B as
 import { n as standardSchemaToJSONSchema, r as toStandardSchema } from "../../schema-e0VHpMt0-CvPvLS06.js";
 import { n as createRoute } from "../../route-builder-lBil8Cvo.js";
 import "../../schema-Xxr5X5Je.js";
-import { c as toSlug, l as stringify } from "../../utils-DTgkpEdc.js";
-import { f as WORKSPACE_TOOLS, h as resolveToolConfig, i as MASTRA_IS_STUDIO_KEY, o as MASTRA_RESOURCE_ID_KEY } from "../../constants-1TDVXCCT.js";
+import { c as toSlug, l as stringify } from "../../utils-BpQY-tBr.js";
+import { f as WORKSPACE_TOOLS, h as resolveToolConfig, i as MASTRA_IS_STUDIO_KEY, o as MASTRA_RESOURCE_ID_KEY } from "../../constants-C631oS02.js";
 import { handleError } from "./error.js";
-import { d as stripClientCredentialHeaders, f as validateBody, h as MastraFGAPermissions, i as getEffectiveThreadId, l as requireEffectiveResourceId, m as validateThreadOwnership, n as getContextResourceId, o as mergeBodyRequestContext, p as validateRunOwnership, r as getEffectiveResourceId, t as enforceThreadAccess, u as sanitizeBody } from "../../utils-UwDFLi8y.js";
+import { d as stripClientCredentialHeaders, f as validateBody, h as MastraFGAPermissions, i as getEffectiveThreadId, l as requireEffectiveResourceId, m as validateThreadOwnership, n as getContextResourceId, o as mergeBodyRequestContext, p as validateRunOwnership, r as getEffectiveResourceId, t as enforceThreadAccess, u as sanitizeBody } from "../../utils-GVYTDbr2.js";
 import { r as createStoredAgentResponseSchema } from "../../stored-agents-BtaEzKfr.js";
 import { O as skillDisambiguationQuerySchema, h as getAgentSkillResponseSchema } from "../../workspace-4dBGFdV2.js";
 import { stripInjectedToolOverrideFields } from "./tool-schema-overrides.js";
@@ -103,7 +103,7 @@ function getIsStudioFromContext(requestContext) {
 }
 function normalizePublicExecutionOptions(options, serverRequestContext) {
 	if (!options || typeof options !== "object" || Array.isArray(options)) return void 0;
-	const { actor: _actor, requestContext, ...normalized } = options;
+	const { actor: _actor, scopes: _scopes, requestContext, ...normalized } = options;
 	stripClientCredentialHeaders(normalized);
 	mergeBodyRequestContext(serverRequestContext, requestContext);
 	return {
@@ -953,7 +953,11 @@ const GENERATE_AGENT_ROUTE = createRoute({
 	requiresPermission: MastraFGAPermissions.AGENTS_EXECUTE,
 	handler: async ({ agentId, mastra, abortSignal, requestContext: serverRequestContext, ...params }) => {
 		try {
-			sanitizeBody(params, ["tools", "actor"]);
+			sanitizeBody(params, [
+				"tools",
+				"actor",
+				"scopes"
+			]);
 			stripClientCredentialHeaders(params);
 			const { messages, memory: memoryOption, requestContext: bodyRequestContext, versions, ...rest } = params;
 			validateBody({ messages });
@@ -1029,7 +1033,11 @@ const GENERATE_LEGACY_ROUTE = createRoute({
 				versionOptions: extractVersionOptions(requestContext),
 				requestContext
 			});
-			sanitizeBody(params, ["tools", "actor"]);
+			sanitizeBody(params, [
+				"tools",
+				"actor",
+				"scopes"
+			]);
 			stripClientCredentialHeaders(params);
 			const { messages, resourceId, resourceid, threadId, ...rest } = params;
 			const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId ?? resourceid);
@@ -1080,7 +1088,11 @@ const STREAM_GENERATE_LEGACY_ROUTE = createRoute({
 				versionOptions: extractVersionOptions(requestContext),
 				requestContext
 			});
-			sanitizeBody(params, ["tools", "actor"]);
+			sanitizeBody(params, [
+				"tools",
+				"actor",
+				"scopes"
+			]);
 			stripClientCredentialHeaders(params);
 			const { messages, resourceId, resourceid, threadId, ...rest } = params;
 			const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId ?? resourceid);
@@ -1215,7 +1227,11 @@ const STREAM_GENERATE_ROUTE = createRoute({
 	requiresPermission: MastraFGAPermissions.AGENTS_EXECUTE,
 	handler: async ({ mastra, agentId, abortSignal, requestContext: serverRequestContext, ...params }) => {
 		try {
-			sanitizeBody(params, ["tools", "actor"]);
+			sanitizeBody(params, [
+				"tools",
+				"actor",
+				"scopes"
+			]);
 			stripClientCredentialHeaders(params);
 			const { messages, memory: memoryOption, requestContext: bodyRequestContext, versions, ...rest } = params;
 			validateBody({ messages });
@@ -1690,7 +1706,11 @@ const STREAM_UNTIL_IDLE_GENERATE_ROUTE = createRoute({
 	requiresPermission: MastraFGAPermissions.AGENTS_EXECUTE,
 	handler: async ({ mastra, agentId, abortSignal, requestContext: serverRequestContext, ...params }) => {
 		try {
-			sanitizeBody(params, ["tools", "actor"]);
+			sanitizeBody(params, [
+				"tools",
+				"actor",
+				"scopes"
+			]);
 			stripClientCredentialHeaders(params);
 			const { messages, memory: memoryOption, requestContext: bodyRequestContext, ...rest } = params;
 			validateBody({ messages });
@@ -1855,7 +1875,11 @@ const APPROVE_TOOL_CALL_ROUTE = createRoute({
 			});
 			if (!params.runId) throw new HTTPException(400, { message: "Run id is required" });
 			if (!params.toolCallId) throw new HTTPException(400, { message: "Tool call id is required" });
-			sanitizeBody(params, ["tools", "actor"]);
+			sanitizeBody(params, [
+				"tools",
+				"actor",
+				"scopes"
+			]);
 			stripClientCredentialHeaders(params);
 			await validateDurableToolCallAccess({
 				mastra,
@@ -1911,7 +1935,11 @@ const SEND_TOOL_APPROVAL_ROUTE = createRoute({
 			});
 			if (!params.toolCallId) throw new HTTPException(400, { message: "Tool call id is required" });
 			mergeBodyRequestContext(serverRequestContext, bodyRequestContext);
-			sanitizeBody(params, ["tools", "actor"]);
+			sanitizeBody(params, [
+				"tools",
+				"actor",
+				"scopes"
+			]);
 			stripClientCredentialHeaders(params);
 			const normalizedStreamOptions = normalizePublicExecutionOptions(params.streamOptions, serverRequestContext);
 			const { effectiveResourceId, effectiveThreadId } = await validateSubscriptionToolCallThreadAccess({
@@ -2000,7 +2028,11 @@ const DECLINE_TOOL_CALL_ROUTE = createRoute({
 			});
 			if (!params.runId) throw new HTTPException(400, { message: "Run id is required" });
 			if (!params.toolCallId) throw new HTTPException(400, { message: "Tool call id is required" });
-			sanitizeBody(params, ["tools", "actor"]);
+			sanitizeBody(params, [
+				"tools",
+				"actor",
+				"scopes"
+			]);
 			stripClientCredentialHeaders(params);
 			await validateDurableToolCallAccess({
 				mastra,
@@ -2036,7 +2068,11 @@ const RESUME_STREAM_ROUTE = createRoute({
 	handler: async ({ mastra, agentId, abortSignal, requestContext: serverRequestContext, ...params }) => {
 		try {
 			if (!params.runId) throw new HTTPException(400, { message: "Run id is required" });
-			sanitizeBody(params, ["tools", "actor"]);
+			sanitizeBody(params, [
+				"tools",
+				"actor",
+				"scopes"
+			]);
 			stripClientCredentialHeaders(params);
 			const { resumeData, runId, toolCallId, memory: memoryOption, requestContext: bodyRequestContext, versions, ...rest } = params;
 			const versionOptions = extractVersionOptions(serverRequestContext, bodyRequestContext);
@@ -2158,7 +2194,11 @@ const RESUME_STREAM_UNTIL_IDLE_ROUTE = createRoute({
 	handler: async ({ mastra, agentId, abortSignal, requestContext: serverRequestContext, ...params }) => {
 		try {
 			if (!params.runId) throw new HTTPException(400, { message: "Run id is required" });
-			sanitizeBody(params, ["tools", "actor"]);
+			sanitizeBody(params, [
+				"tools",
+				"actor",
+				"scopes"
+			]);
 			stripClientCredentialHeaders(params);
 			const { resumeData, runId, toolCallId, memory: memoryOption, requestContext: bodyRequestContext, versions, ...rest } = params;
 			const versionOptions = extractVersionOptions(serverRequestContext, bodyRequestContext);
@@ -2246,7 +2286,11 @@ const APPROVE_TOOL_CALL_GENERATE_ROUTE = createRoute({
 			});
 			if (!params.runId) throw new HTTPException(400, { message: "Run id is required" });
 			if (!params.toolCallId) throw new HTTPException(400, { message: "Tool call id is required" });
-			sanitizeBody(params, ["tools", "actor"]);
+			sanitizeBody(params, [
+				"tools",
+				"actor",
+				"scopes"
+			]);
 			stripClientCredentialHeaders(params);
 			await validateDurableToolCallAccess({
 				mastra,
@@ -2286,7 +2330,11 @@ const DECLINE_TOOL_CALL_GENERATE_ROUTE = createRoute({
 			});
 			if (!params.runId) throw new HTTPException(400, { message: "Run id is required" });
 			if (!params.toolCallId) throw new HTTPException(400, { message: "Tool call id is required" });
-			sanitizeBody(params, ["tools", "actor"]);
+			sanitizeBody(params, [
+				"tools",
+				"actor",
+				"scopes"
+			]);
 			stripClientCredentialHeaders(params);
 			await validateDurableToolCallAccess({
 				mastra,
@@ -2325,7 +2373,11 @@ const STREAM_NETWORK_ROUTE = createRoute({
 				agentId,
 				versionOptions: extractVersionOptions(requestContext)
 			});
-			sanitizeBody(params, ["tools", "actor"]);
+			sanitizeBody(params, [
+				"tools",
+				"actor",
+				"scopes"
+			]);
 			stripClientCredentialHeaders(params);
 			validateBody({ messages });
 			let authorizedMemoryOption = params.memory;
@@ -2366,7 +2418,11 @@ const APPROVE_NETWORK_TOOL_CALL_ROUTE = createRoute({
 				versionOptions: extractVersionOptions(requestContext)
 			});
 			if (!params.runId) throw new HTTPException(400, { message: "Run id is required" });
-			sanitizeBody(params, ["tools", "actor"]);
+			sanitizeBody(params, [
+				"tools",
+				"actor",
+				"scopes"
+			]);
 			stripClientCredentialHeaders(params);
 			return await agent.approveNetworkToolCall({ ...params });
 		} catch (error) {
@@ -2394,7 +2450,11 @@ const DECLINE_NETWORK_TOOL_CALL_ROUTE = createRoute({
 				versionOptions: extractVersionOptions(requestContext)
 			});
 			if (!params.runId) throw new HTTPException(400, { message: "Run id is required" });
-			sanitizeBody(params, ["tools", "actor"]);
+			sanitizeBody(params, [
+				"tools",
+				"actor",
+				"scopes"
+			]);
 			stripClientCredentialHeaders(params);
 			return await agent.declineNetworkToolCall({ ...params });
 		} catch (error) {