@mastra/server 1.77.0-alpha.4 → 1.78.0-alpha.0

package/dist/{api-schema-manifest-DC45FBI7.cjs → api-schema-manifest-7Mkcahcz.cjs}

@@ -1,6 +1,6 @@
 require("./rolldown-runtime-Bd6kNlEP.cjs");
 const require_route_builder = require("./route-builder-2yrD15TL.cjs");
-const require_routes = require("./routes-Dl6lzZIQ.cjs");
+const require_routes = require("./routes-BOpfBZw5.cjs");
 //#region src/server/server-adapter/api-schema-manifest.ts
 function convertSchema(schema) {
 	return schema ? require_route_builder.schemaToJsonSchema(schema) : void 0;
@@ -53,4 +53,4 @@ function buildApiSchemaManifest(routes = require_routes.SERVER_ROUTES) {
 //#endregion
 exports.buildApiSchemaManifest = buildApiSchemaManifest;
 
-//# sourceMappingURL=api-schema-manifest-DC45FBI7.cjs.map
+//# sourceMappingURL=api-schema-manifest-7Mkcahcz.cjs.map

package/dist/{api-schema-manifest-DC45FBI7.cjs.map → api-schema-manifest-7Mkcahcz.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"api-schema-manifest-DC45FBI7.cjs","names":["schemaToJsonSchema","SERVER_ROUTES"],"sources":["../src/server/server-adapter/api-schema-manifest.ts"],"sourcesContent":["import type { JSONSchema7 } from '@mastra/schema-compat';\nimport { schemaToJsonSchema } from './openapi-utils';\nimport { SERVER_ROUTES } from './routes/index';\nimport type { ServerRoute } from './routes/index';\n\nexport interface ApiSchemaResponseShape {\n  kind: 'array' | 'record' | 'object-property' | 'single' | 'unknown';\n  listProperty?: string;\n  paginationProperty?: string;\n}\n\nexport interface ApiSchemaManifestRoute {\n  method: string;\n  path: string;\n  responseType: string;\n  pathParamSchema?: JSONSchema7;\n  queryParamSchema?: JSONSchema7;\n  bodySchema?: JSONSchema7;\n  responseSchema?: JSONSchema7;\n  responseShape: ApiSchemaResponseShape;\n}\n\nexport interface ApiSchemaManifest {\n  version: 1;\n  routes: ApiSchemaManifestRoute[];\n}\n\nfunction convertSchema(schema: ServerRoute['bodySchema']): JSONSchema7 | undefined {\n  return schema ? schemaToJsonSchema(schema) : undefined;\n}\n\nfunction asJsonSchema(value: unknown): JSONSchema7 | undefined {\n  return value && typeof value === 'object' && !Array.isArray(value) ? (value as JSONSchema7) : undefined;\n}\n\nfunction schemaType(schema: JSONSchema7 | undefined): JSONSchema7['type'] | undefined {\n  const type = schema?.type;\n  return Array.isArray(type) ? type.find(Boolean) : type;\n}\n\nfunction inferResponseShape(responseSchema: JSONSchema7 | undefined): ApiSchemaResponseShape {\n  if (!responseSchema) return { kind: 'unknown' };\n\n  const type = schemaType(responseSchema);\n  if (type === 'array') return { kind: 'array' };\n  if (type !== 'object') return { kind: 'single' };\n\n  const properties =\n    responseSchema.properties && !Array.isArray(responseSchema.properties) ? responseSchema.properties : {};\n  const propertyNames = Object.keys(properties);\n  const paginationProperty = 'page' in properties ? 'page' : 'pagination' in properties ? 'pagination' : undefined;\n  const listProperty = Object.entries(properties).find(\n    ([, property]) => schemaType(asJsonSchema(property)) === 'array',\n  )?.[0];\n\n  if (listProperty && (paginationProperty || propertyNames.length <= 2)) {\n    return { kind: 'object-property', listProperty, paginationProperty };\n  }\n  if (responseSchema.additionalProperties && propertyNames.length === 0) return { kind: 'record' };\n  return { kind: 'single' };\n}\n\nfunction isManifestRoute(route: ServerRoute): boolean {\n  return route.responseType === 'json' && !route.deprecated;\n}\n\nexport function buildApiSchemaManifest(routes: readonly ServerRoute[] = SERVER_ROUTES): ApiSchemaManifest {\n  return {\n    version: 1,\n    routes: routes.filter(isManifestRoute).map(route => {\n      const responseSchema = convertSchema(route.responseSchema);\n      return {\n        method: route.method,\n        path: route.path,\n        responseType: route.responseType,\n        pathParamSchema: convertSchema(route.pathParamSchema),\n        queryParamSchema: convertSchema(route.queryParamSchema),\n        bodySchema: convertSchema(route.bodySchema),\n        responseSchema,\n        responseShape: inferResponseShape(responseSchema),\n      };\n    }),\n  };\n}\n"],"mappings":";;;;AA2BA,SAAS,cAAc,QAA4D;CACjF,OAAO,SAASA,sBAAAA,mBAAmB,MAAM,IAAI,KAAA;AAC/C;AAEA,SAAS,aAAa,OAAyC;CAC7D,OAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAK,QAAwB,KAAA;AAChG;AAEA,SAAS,WAAW,QAAkE;CACpF,MAAM,OAAO,QAAQ;CACrB,OAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK,OAAO,IAAI;AACpD;AAEA,SAAS,mBAAmB,gBAAiE;CAC3F,IAAI,CAAC,gBAAgB,OAAO,EAAE,MAAM,UAAU;CAE9C,MAAM,OAAO,WAAW,cAAc;CACtC,IAAI,SAAS,SAAS,OAAO,EAAE,MAAM,QAAQ;CAC7C,IAAI,SAAS,UAAU,OAAO,EAAE,MAAM,SAAS;CAE/C,MAAM,aACJ,eAAe,cAAc,CAAC,MAAM,QAAQ,eAAe,UAAU,IAAI,eAAe,aAAa,CAAC;CACxG,MAAM,gBAAgB,OAAO,KAAK,UAAU;CAC5C,MAAM,qBAAqB,UAAU,aAAa,SAAS,gBAAgB,aAAa,eAAe,KAAA;CACvG,MAAM,eAAe,OAAO,QAAQ,UAAU,CAAC,CAAC,MAC7C,GAAG,cAAc,WAAW,aAAa,QAAQ,CAAC,MAAM,OAC3D,CAAC,GAAG;CAEJ,IAAI,iBAAiB,sBAAsB,cAAc,UAAU,IACjE,OAAO;EAAE,MAAM;EAAmB;EAAc;CAAmB;CAErE,IAAI,eAAe,wBAAwB,cAAc,WAAW,GAAG,OAAO,EAAE,MAAM,SAAS;CAC/F,OAAO,EAAE,MAAM,SAAS;AAC1B;AAEA,SAAS,gBAAgB,OAA6B;CACpD,OAAO,MAAM,iBAAiB,UAAU,CAAC,MAAM;AACjD;AAEA,SAAgB,uBAAuB,SAAiCC,eAAAA,eAAkC;CACxG,OAAO;EACL,SAAS;EACT,QAAQ,OAAO,OAAO,eAAe,CAAC,CAAC,KAAI,UAAS;GAClD,MAAM,iBAAiB,cAAc,MAAM,cAAc;GACzD,OAAO;IACL,QAAQ,MAAM;IACd,MAAM,MAAM;IACZ,cAAc,MAAM;IACpB,iBAAiB,cAAc,MAAM,eAAe;IACpD,kBAAkB,cAAc,MAAM,gBAAgB;IACtD,YAAY,cAAc,MAAM,UAAU;IAC1C;IACA,eAAe,mBAAmB,cAAc;GAClD;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"api-schema-manifest-7Mkcahcz.cjs","names":["schemaToJsonSchema","SERVER_ROUTES"],"sources":["../src/server/server-adapter/api-schema-manifest.ts"],"sourcesContent":["import type { JSONSchema7 } from '@mastra/schema-compat';\nimport { schemaToJsonSchema } from './openapi-utils';\nimport { SERVER_ROUTES } from './routes/index';\nimport type { ServerRoute } from './routes/index';\n\nexport interface ApiSchemaResponseShape {\n  kind: 'array' | 'record' | 'object-property' | 'single' | 'unknown';\n  listProperty?: string;\n  paginationProperty?: string;\n}\n\nexport interface ApiSchemaManifestRoute {\n  method: string;\n  path: string;\n  responseType: string;\n  pathParamSchema?: JSONSchema7;\n  queryParamSchema?: JSONSchema7;\n  bodySchema?: JSONSchema7;\n  responseSchema?: JSONSchema7;\n  responseShape: ApiSchemaResponseShape;\n}\n\nexport interface ApiSchemaManifest {\n  version: 1;\n  routes: ApiSchemaManifestRoute[];\n}\n\nfunction convertSchema(schema: ServerRoute['bodySchema']): JSONSchema7 | undefined {\n  return schema ? schemaToJsonSchema(schema) : undefined;\n}\n\nfunction asJsonSchema(value: unknown): JSONSchema7 | undefined {\n  return value && typeof value === 'object' && !Array.isArray(value) ? (value as JSONSchema7) : undefined;\n}\n\nfunction schemaType(schema: JSONSchema7 | undefined): JSONSchema7['type'] | undefined {\n  const type = schema?.type;\n  return Array.isArray(type) ? type.find(Boolean) : type;\n}\n\nfunction inferResponseShape(responseSchema: JSONSchema7 | undefined): ApiSchemaResponseShape {\n  if (!responseSchema) return { kind: 'unknown' };\n\n  const type = schemaType(responseSchema);\n  if (type === 'array') return { kind: 'array' };\n  if (type !== 'object') return { kind: 'single' };\n\n  const properties =\n    responseSchema.properties && !Array.isArray(responseSchema.properties) ? responseSchema.properties : {};\n  const propertyNames = Object.keys(properties);\n  const paginationProperty = 'page' in properties ? 'page' : 'pagination' in properties ? 'pagination' : undefined;\n  const listProperty = Object.entries(properties).find(\n    ([, property]) => schemaType(asJsonSchema(property)) === 'array',\n  )?.[0];\n\n  if (listProperty && (paginationProperty || propertyNames.length <= 2)) {\n    return { kind: 'object-property', listProperty, paginationProperty };\n  }\n  if (responseSchema.additionalProperties && propertyNames.length === 0) return { kind: 'record' };\n  return { kind: 'single' };\n}\n\nfunction isManifestRoute(route: ServerRoute): boolean {\n  return route.responseType === 'json' && !route.deprecated;\n}\n\nexport function buildApiSchemaManifest(routes: readonly ServerRoute[] = SERVER_ROUTES): ApiSchemaManifest {\n  return {\n    version: 1,\n    routes: routes.filter(isManifestRoute).map(route => {\n      const responseSchema = convertSchema(route.responseSchema);\n      return {\n        method: route.method,\n        path: route.path,\n        responseType: route.responseType,\n        pathParamSchema: convertSchema(route.pathParamSchema),\n        queryParamSchema: convertSchema(route.queryParamSchema),\n        bodySchema: convertSchema(route.bodySchema),\n        responseSchema,\n        responseShape: inferResponseShape(responseSchema),\n      };\n    }),\n  };\n}\n"],"mappings":";;;;AA2BA,SAAS,cAAc,QAA4D;CACjF,OAAO,SAASA,sBAAAA,mBAAmB,MAAM,IAAI,KAAA;AAC/C;AAEA,SAAS,aAAa,OAAyC;CAC7D,OAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAK,QAAwB,KAAA;AAChG;AAEA,SAAS,WAAW,QAAkE;CACpF,MAAM,OAAO,QAAQ;CACrB,OAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK,OAAO,IAAI;AACpD;AAEA,SAAS,mBAAmB,gBAAiE;CAC3F,IAAI,CAAC,gBAAgB,OAAO,EAAE,MAAM,UAAU;CAE9C,MAAM,OAAO,WAAW,cAAc;CACtC,IAAI,SAAS,SAAS,OAAO,EAAE,MAAM,QAAQ;CAC7C,IAAI,SAAS,UAAU,OAAO,EAAE,MAAM,SAAS;CAE/C,MAAM,aACJ,eAAe,cAAc,CAAC,MAAM,QAAQ,eAAe,UAAU,IAAI,eAAe,aAAa,CAAC;CACxG,MAAM,gBAAgB,OAAO,KAAK,UAAU;CAC5C,MAAM,qBAAqB,UAAU,aAAa,SAAS,gBAAgB,aAAa,eAAe,KAAA;CACvG,MAAM,eAAe,OAAO,QAAQ,UAAU,CAAC,CAAC,MAC7C,GAAG,cAAc,WAAW,aAAa,QAAQ,CAAC,MAAM,OAC3D,CAAC,GAAG;CAEJ,IAAI,iBAAiB,sBAAsB,cAAc,UAAU,IACjE,OAAO;EAAE,MAAM;EAAmB;EAAc;CAAmB;CAErE,IAAI,eAAe,wBAAwB,cAAc,WAAW,GAAG,OAAO,EAAE,MAAM,SAAS;CAC/F,OAAO,EAAE,MAAM,SAAS;AAC1B;AAEA,SAAS,gBAAgB,OAA6B;CACpD,OAAO,MAAM,iBAAiB,UAAU,CAAC,MAAM;AACjD;AAEA,SAAgB,uBAAuB,SAAiCC,eAAAA,eAAkC;CACxG,OAAO;EACL,SAAS;EACT,QAAQ,OAAO,OAAO,eAAe,CAAC,CAAC,KAAI,UAAS;GAClD,MAAM,iBAAiB,cAAc,MAAM,cAAc;GACzD,OAAO;IACL,QAAQ,MAAM;IACd,MAAM,MAAM;IACZ,cAAc,MAAM;IACpB,iBAAiB,cAAc,MAAM,eAAe;IACpD,kBAAkB,cAAc,MAAM,gBAAgB;IACtD,YAAY,cAAc,MAAM,UAAU;IAC1C;IACA,eAAe,mBAAmB,cAAc;GAClD;EACF,CAAC;CACH;AACF"}

package/dist/{api-schema-manifest-BQOonczJ.js → api-schema-manifest-BSc3N7kx.js}

@@ -1,5 +1,5 @@
 import { c as schemaToJsonSchema } from "./route-builder-lBil8Cvo.js";
-import { t as SERVER_ROUTES } from "./routes-DhwMARHw.js";
+import { t as SERVER_ROUTES } from "./routes-CccVLchZ.js";
 //#region src/server/server-adapter/api-schema-manifest.ts
 function convertSchema(schema) {
 	return schema ? schemaToJsonSchema(schema) : void 0;
@@ -52,4 +52,4 @@ function buildApiSchemaManifest(routes = SERVER_ROUTES) {
 //#endregion
 export { buildApiSchemaManifest };
 
-//# sourceMappingURL=api-schema-manifest-BQOonczJ.js.map
+//# sourceMappingURL=api-schema-manifest-BSc3N7kx.js.map

package/dist/{api-schema-manifest-BQOonczJ.js.map → api-schema-manifest-BSc3N7kx.js.map}

@@ -1 +1 @@
-{"version":3,"file":"api-schema-manifest-BQOonczJ.js","names":[],"sources":["../src/server/server-adapter/api-schema-manifest.ts"],"sourcesContent":["import type { JSONSchema7 } from '@mastra/schema-compat';\nimport { schemaToJsonSchema } from './openapi-utils';\nimport { SERVER_ROUTES } from './routes/index';\nimport type { ServerRoute } from './routes/index';\n\nexport interface ApiSchemaResponseShape {\n  kind: 'array' | 'record' | 'object-property' | 'single' | 'unknown';\n  listProperty?: string;\n  paginationProperty?: string;\n}\n\nexport interface ApiSchemaManifestRoute {\n  method: string;\n  path: string;\n  responseType: string;\n  pathParamSchema?: JSONSchema7;\n  queryParamSchema?: JSONSchema7;\n  bodySchema?: JSONSchema7;\n  responseSchema?: JSONSchema7;\n  responseShape: ApiSchemaResponseShape;\n}\n\nexport interface ApiSchemaManifest {\n  version: 1;\n  routes: ApiSchemaManifestRoute[];\n}\n\nfunction convertSchema(schema: ServerRoute['bodySchema']): JSONSchema7 | undefined {\n  return schema ? schemaToJsonSchema(schema) : undefined;\n}\n\nfunction asJsonSchema(value: unknown): JSONSchema7 | undefined {\n  return value && typeof value === 'object' && !Array.isArray(value) ? (value as JSONSchema7) : undefined;\n}\n\nfunction schemaType(schema: JSONSchema7 | undefined): JSONSchema7['type'] | undefined {\n  const type = schema?.type;\n  return Array.isArray(type) ? type.find(Boolean) : type;\n}\n\nfunction inferResponseShape(responseSchema: JSONSchema7 | undefined): ApiSchemaResponseShape {\n  if (!responseSchema) return { kind: 'unknown' };\n\n  const type = schemaType(responseSchema);\n  if (type === 'array') return { kind: 'array' };\n  if (type !== 'object') return { kind: 'single' };\n\n  const properties =\n    responseSchema.properties && !Array.isArray(responseSchema.properties) ? responseSchema.properties : {};\n  const propertyNames = Object.keys(properties);\n  const paginationProperty = 'page' in properties ? 'page' : 'pagination' in properties ? 'pagination' : undefined;\n  const listProperty = Object.entries(properties).find(\n    ([, property]) => schemaType(asJsonSchema(property)) === 'array',\n  )?.[0];\n\n  if (listProperty && (paginationProperty || propertyNames.length <= 2)) {\n    return { kind: 'object-property', listProperty, paginationProperty };\n  }\n  if (responseSchema.additionalProperties && propertyNames.length === 0) return { kind: 'record' };\n  return { kind: 'single' };\n}\n\nfunction isManifestRoute(route: ServerRoute): boolean {\n  return route.responseType === 'json' && !route.deprecated;\n}\n\nexport function buildApiSchemaManifest(routes: readonly ServerRoute[] = SERVER_ROUTES): ApiSchemaManifest {\n  return {\n    version: 1,\n    routes: routes.filter(isManifestRoute).map(route => {\n      const responseSchema = convertSchema(route.responseSchema);\n      return {\n        method: route.method,\n        path: route.path,\n        responseType: route.responseType,\n        pathParamSchema: convertSchema(route.pathParamSchema),\n        queryParamSchema: convertSchema(route.queryParamSchema),\n        bodySchema: convertSchema(route.bodySchema),\n        responseSchema,\n        responseShape: inferResponseShape(responseSchema),\n      };\n    }),\n  };\n}\n"],"mappings":";;;AA2BA,SAAS,cAAc,QAA4D;CACjF,OAAO,SAAS,mBAAmB,MAAM,IAAI,KAAA;AAC/C;AAEA,SAAS,aAAa,OAAyC;CAC7D,OAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAK,QAAwB,KAAA;AAChG;AAEA,SAAS,WAAW,QAAkE;CACpF,MAAM,OAAO,QAAQ;CACrB,OAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK,OAAO,IAAI;AACpD;AAEA,SAAS,mBAAmB,gBAAiE;CAC3F,IAAI,CAAC,gBAAgB,OAAO,EAAE,MAAM,UAAU;CAE9C,MAAM,OAAO,WAAW,cAAc;CACtC,IAAI,SAAS,SAAS,OAAO,EAAE,MAAM,QAAQ;CAC7C,IAAI,SAAS,UAAU,OAAO,EAAE,MAAM,SAAS;CAE/C,MAAM,aACJ,eAAe,cAAc,CAAC,MAAM,QAAQ,eAAe,UAAU,IAAI,eAAe,aAAa,CAAC;CACxG,MAAM,gBAAgB,OAAO,KAAK,UAAU;CAC5C,MAAM,qBAAqB,UAAU,aAAa,SAAS,gBAAgB,aAAa,eAAe,KAAA;CACvG,MAAM,eAAe,OAAO,QAAQ,UAAU,CAAC,CAAC,MAC7C,GAAG,cAAc,WAAW,aAAa,QAAQ,CAAC,MAAM,OAC3D,CAAC,GAAG;CAEJ,IAAI,iBAAiB,sBAAsB,cAAc,UAAU,IACjE,OAAO;EAAE,MAAM;EAAmB;EAAc;CAAmB;CAErE,IAAI,eAAe,wBAAwB,cAAc,WAAW,GAAG,OAAO,EAAE,MAAM,SAAS;CAC/F,OAAO,EAAE,MAAM,SAAS;AAC1B;AAEA,SAAS,gBAAgB,OAA6B;CACpD,OAAO,MAAM,iBAAiB,UAAU,CAAC,MAAM;AACjD;AAEA,SAAgB,uBAAuB,SAAiC,eAAkC;CACxG,OAAO;EACL,SAAS;EACT,QAAQ,OAAO,OAAO,eAAe,CAAC,CAAC,KAAI,UAAS;GAClD,MAAM,iBAAiB,cAAc,MAAM,cAAc;GACzD,OAAO;IACL,QAAQ,MAAM;IACd,MAAM,MAAM;IACZ,cAAc,MAAM;IACpB,iBAAiB,cAAc,MAAM,eAAe;IACpD,kBAAkB,cAAc,MAAM,gBAAgB;IACtD,YAAY,cAAc,MAAM,UAAU;IAC1C;IACA,eAAe,mBAAmB,cAAc;GAClD;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"api-schema-manifest-BSc3N7kx.js","names":[],"sources":["../src/server/server-adapter/api-schema-manifest.ts"],"sourcesContent":["import type { JSONSchema7 } from '@mastra/schema-compat';\nimport { schemaToJsonSchema } from './openapi-utils';\nimport { SERVER_ROUTES } from './routes/index';\nimport type { ServerRoute } from './routes/index';\n\nexport interface ApiSchemaResponseShape {\n  kind: 'array' | 'record' | 'object-property' | 'single' | 'unknown';\n  listProperty?: string;\n  paginationProperty?: string;\n}\n\nexport interface ApiSchemaManifestRoute {\n  method: string;\n  path: string;\n  responseType: string;\n  pathParamSchema?: JSONSchema7;\n  queryParamSchema?: JSONSchema7;\n  bodySchema?: JSONSchema7;\n  responseSchema?: JSONSchema7;\n  responseShape: ApiSchemaResponseShape;\n}\n\nexport interface ApiSchemaManifest {\n  version: 1;\n  routes: ApiSchemaManifestRoute[];\n}\n\nfunction convertSchema(schema: ServerRoute['bodySchema']): JSONSchema7 | undefined {\n  return schema ? schemaToJsonSchema(schema) : undefined;\n}\n\nfunction asJsonSchema(value: unknown): JSONSchema7 | undefined {\n  return value && typeof value === 'object' && !Array.isArray(value) ? (value as JSONSchema7) : undefined;\n}\n\nfunction schemaType(schema: JSONSchema7 | undefined): JSONSchema7['type'] | undefined {\n  const type = schema?.type;\n  return Array.isArray(type) ? type.find(Boolean) : type;\n}\n\nfunction inferResponseShape(responseSchema: JSONSchema7 | undefined): ApiSchemaResponseShape {\n  if (!responseSchema) return { kind: 'unknown' };\n\n  const type = schemaType(responseSchema);\n  if (type === 'array') return { kind: 'array' };\n  if (type !== 'object') return { kind: 'single' };\n\n  const properties =\n    responseSchema.properties && !Array.isArray(responseSchema.properties) ? responseSchema.properties : {};\n  const propertyNames = Object.keys(properties);\n  const paginationProperty = 'page' in properties ? 'page' : 'pagination' in properties ? 'pagination' : undefined;\n  const listProperty = Object.entries(properties).find(\n    ([, property]) => schemaType(asJsonSchema(property)) === 'array',\n  )?.[0];\n\n  if (listProperty && (paginationProperty || propertyNames.length <= 2)) {\n    return { kind: 'object-property', listProperty, paginationProperty };\n  }\n  if (responseSchema.additionalProperties && propertyNames.length === 0) return { kind: 'record' };\n  return { kind: 'single' };\n}\n\nfunction isManifestRoute(route: ServerRoute): boolean {\n  return route.responseType === 'json' && !route.deprecated;\n}\n\nexport function buildApiSchemaManifest(routes: readonly ServerRoute[] = SERVER_ROUTES): ApiSchemaManifest {\n  return {\n    version: 1,\n    routes: routes.filter(isManifestRoute).map(route => {\n      const responseSchema = convertSchema(route.responseSchema);\n      return {\n        method: route.method,\n        path: route.path,\n        responseType: route.responseType,\n        pathParamSchema: convertSchema(route.pathParamSchema),\n        queryParamSchema: convertSchema(route.queryParamSchema),\n        bodySchema: convertSchema(route.bodySchema),\n        responseSchema,\n        responseShape: inferResponseShape(responseSchema),\n      };\n    }),\n  };\n}\n"],"mappings":";;;AA2BA,SAAS,cAAc,QAA4D;CACjF,OAAO,SAAS,mBAAmB,MAAM,IAAI,KAAA;AAC/C;AAEA,SAAS,aAAa,OAAyC;CAC7D,OAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAK,QAAwB,KAAA;AAChG;AAEA,SAAS,WAAW,QAAkE;CACpF,MAAM,OAAO,QAAQ;CACrB,OAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK,OAAO,IAAI;AACpD;AAEA,SAAS,mBAAmB,gBAAiE;CAC3F,IAAI,CAAC,gBAAgB,OAAO,EAAE,MAAM,UAAU;CAE9C,MAAM,OAAO,WAAW,cAAc;CACtC,IAAI,SAAS,SAAS,OAAO,EAAE,MAAM,QAAQ;CAC7C,IAAI,SAAS,UAAU,OAAO,EAAE,MAAM,SAAS;CAE/C,MAAM,aACJ,eAAe,cAAc,CAAC,MAAM,QAAQ,eAAe,UAAU,IAAI,eAAe,aAAa,CAAC;CACxG,MAAM,gBAAgB,OAAO,KAAK,UAAU;CAC5C,MAAM,qBAAqB,UAAU,aAAa,SAAS,gBAAgB,aAAa,eAAe,KAAA;CACvG,MAAM,eAAe,OAAO,QAAQ,UAAU,CAAC,CAAC,MAC7C,GAAG,cAAc,WAAW,aAAa,QAAQ,CAAC,MAAM,OAC3D,CAAC,GAAG;CAEJ,IAAI,iBAAiB,sBAAsB,cAAc,UAAU,IACjE,OAAO;EAAE,MAAM;EAAmB;EAAc;CAAmB;CAErE,IAAI,eAAe,wBAAwB,cAAc,WAAW,GAAG,OAAO,EAAE,MAAM,SAAS;CAC/F,OAAO,EAAE,MAAM,SAAS;AAC1B;AAEA,SAAS,gBAAgB,OAA6B;CACpD,OAAO,MAAM,iBAAiB,UAAU,CAAC,MAAM;AACjD;AAEA,SAAgB,uBAAuB,SAAiC,eAAkC;CACxG,OAAO;EACL,SAAS;EACT,QAAQ,OAAO,OAAO,eAAe,CAAC,CAAC,KAAI,UAAS;GAClD,MAAM,iBAAiB,cAAc,MAAM,cAAc;GACzD,OAAO;IACL,QAAQ,MAAM;IACd,MAAM,MAAM;IACZ,cAAc,MAAM;IACpB,iBAAiB,cAAc,MAAM,eAAe;IACpD,kBAAkB,cAAc,MAAM,gBAAgB;IACtD,YAAY,cAAc,MAAM,UAAU;IAC1C;IACA,eAAe,mBAAmB,cAAc;GAClD;EACF,CAAC;CACH;AACF"}

package/dist/{background-tasks-CIp3Ltam.cjs → background-tasks-Cu89GYC6.cjs}

@@ -1,6 +1,7 @@
 const require_http_exception = require("./http-exception-CKDHupKw.cjs");
 const require_common = require("./common-DhKNoXGp.cjs");
 const require_route_builder = require("./route-builder-2yrD15TL.cjs");
+const require_utils = require("./utils-BF2Kbju4.cjs");
 let zod = require("zod");
 //#region src/server/schemas/background-tasks.ts
 const backgroundTaskStatusSchema = zod.z.enum([
@@ -72,6 +73,24 @@ const listBackgroundTaskResponseSchema = zod.z.object({
 const backgroundTaskStreamResponseSchema = zod.z.unknown();
 //#endregion
 //#region src/server/handlers/background-tasks.ts
+/**
+* Resolves the resource filter for a background-task request. A resource-scoped caller
+* is pinned to its own resource and may not request another one; a privileged caller
+* (no resource in the request context) keeps the client-provided filter.
+*/
+function resolveResourceScope(requestContext, clientResourceId) {
+	const contextResourceId = require_utils.getContextResourceId(requestContext);
+	if (contextResourceId === void 0) return {
+		resourceId: clientResourceId,
+		scoped: false
+	};
+	if (contextResourceId === "") throw new require_http_exception.HTTPException(403, { message: "Access denied: authenticated resourceId is empty" });
+	if (clientResourceId !== void 0 && clientResourceId !== contextResourceId) throw new require_http_exception.HTTPException(403, { message: "Access denied: resourceId does not match the authenticated resource" });
+	return {
+		resourceId: contextResourceId,
+		scoped: true
+	};
+}
 const BACKGROUND_TASK_STREAM_ROUTE = require_route_builder.createRoute({
 	method: "GET",
 	path: "/background-tasks/stream",
@@ -83,7 +102,8 @@ const BACKGROUND_TASK_STREAM_ROUTE = require_route_builder.createRoute({
 	description: "Real-time Server-Sent Events stream of background task completion/failure events.",
 	tags: ["Background Tasks"],
 	requiresAuth: true,
-	handler: async ({ mastra, agentId, runId, threadId, resourceId, taskId, abortSignal }) => {
+	handler: async ({ mastra, agentId, runId, threadId, resourceId: clientResourceId, taskId, abortSignal, requestContext }) => {
+		const { resourceId, scoped } = resolveResourceScope(requestContext, clientResourceId);
 		const bgManager = mastra.backgroundTaskManager;
 		if (!bgManager) return new ReadableStream({ start(controller) {
 			abortSignal?.addEventListener("abort", () => {
@@ -98,7 +118,8 @@ const BACKGROUND_TASK_STREAM_ROUTE = require_route_builder.createRoute({
 			threadId,
 			resourceId,
 			taskId,
-			abortSignal
+			abortSignal,
+			allResources: !scoped
 		});
 	}
 });
@@ -112,13 +133,17 @@ const LIST_BACKGROUND_TASKS_ROUTE = require_route_builder.createRoute({
 	description: "Returns background tasks filtered by status, agent, run, etc.",
 	tags: ["Background Tasks"],
 	requiresAuth: true,
-	handler: async ({ mastra, ...params }) => {
+	handler: async ({ mastra, requestContext, ...params }) => {
+		const { resourceId } = resolveResourceScope(requestContext, params.resourceId);
 		const bgManager = mastra.backgroundTaskManager;
 		if (!bgManager) return {
 			tasks: [],
 			total: 0
 		};
-		return bgManager.listTasks(params);
+		return bgManager.listTasks({
+			...params,
+			resourceId
+		});
 	}
 });
 const GET_BACKGROUND_TASK_ROUTE = require_route_builder.createRoute({
@@ -131,11 +156,12 @@ const GET_BACKGROUND_TASK_ROUTE = require_route_builder.createRoute({
 	description: "Returns a background task by ID.",
 	tags: ["Background Tasks"],
 	requiresAuth: true,
-	handler: async ({ mastra, backgroundTaskId }) => {
+	handler: async ({ mastra, backgroundTaskId, requestContext }) => {
+		const { resourceId, scoped } = resolveResourceScope(requestContext, void 0);
 		const bgManager = mastra.backgroundTaskManager;
 		if (!bgManager) throw new require_http_exception.HTTPException(404, { message: "Background task not found" });
 		const task = await bgManager.getTask(backgroundTaskId);
-		if (!task) throw new require_http_exception.HTTPException(404, { message: "Background task not found" });
+		if (!task || scoped && task.resourceId !== resourceId) throw new require_http_exception.HTTPException(404, { message: "Background task not found" });
 		return task;
 	}
 });
@@ -159,4 +185,4 @@ Object.defineProperty(exports, "LIST_BACKGROUND_TASKS_ROUTE", {
 	}
 });
 
-//# sourceMappingURL=background-tasks-CIp3Ltam.cjs.map
+//# sourceMappingURL=background-tasks-Cu89GYC6.cjs.map

package/dist/background-tasks-Cu89GYC6.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"background-tasks-Cu89GYC6.cjs","names":["z","paginationNumber","getContextResourceId","HTTPException","createRoute"],"sources":["../src/server/schemas/background-tasks.ts","../src/server/handlers/background-tasks.ts"],"sourcesContent":["import { z } from 'zod';\nimport { paginationNumber } from './common';\n\nexport const backgroundTaskStatusSchema = z.enum([\n  'pending',\n  'running',\n  'suspended',\n  'completed',\n  'failed',\n  'cancelled',\n  'timed_out',\n]);\n\nexport const backgroundTaskStreamQuerySchema = z.object({\n  agentId: z.string().optional(),\n  runId: z.string().optional(),\n  threadId: z.string().optional(),\n  resourceId: z.string().optional(),\n  taskId: z.string().optional(),\n});\n\nexport const backgroundTaskDateColumnSchema = z.enum(['createdAt', 'startedAt', 'suspendedAt', 'completedAt']);\n\nexport const listBackgroundTasksQuerySchema = z.object({\n  agentId: z.string().optional(),\n  status: backgroundTaskStatusSchema.optional(),\n  runId: z.string().optional(),\n  threadId: z.string().optional(),\n  resourceId: z.string().optional(),\n  toolName: z.string().optional(),\n  toolCallId: z.string().optional(),\n  fromDate: z.coerce.date().optional(),\n  toDate: z.coerce.date().optional(),\n  dateFilterBy: backgroundTaskDateColumnSchema.optional(),\n  orderBy: backgroundTaskDateColumnSchema.optional(),\n  orderDirection: z.enum(['asc', 'desc']).optional(),\n  page: paginationNumber().optional(),\n  perPage: paginationNumber().optional(),\n});\n\nexport const backgroundTaskIdPathParams = z.object({\n  backgroundTaskId: z.string(),\n});\n\nexport const backgroundTaskResponseSchema = z.object({\n  id: z.string(),\n  status: backgroundTaskStatusSchema,\n  toolName: z.string(),\n  toolCallId: z.string(),\n  args: z.record(z.string(), z.unknown()),\n  agentId: z.string(),\n  threadId: z.string().optional(),\n  resourceId: z.string().optional(),\n  runId: z.string(),\n  result: z.unknown().optional(),\n  error: z.object({ message: z.string(), stack: z.string().optional() }).optional(),\n  createdAt: z.date(),\n  startedAt: z.date().optional(),\n  completedAt: z.date().optional(),\n  retryCount: z.number(),\n  maxRetries: z.number(),\n  timeoutMs: z.number(),\n  suspendPayload: z.unknown().optional(),\n});\n\nexport const listBackgroundTaskResponseSchema = z.object({\n  tasks: z.array(backgroundTaskResponseSchema),\n  total: z.number(),\n});\n\nexport const backgroundTaskStreamResponseSchema = z.unknown();\n","import { HTTPException } from '../http-exception';\nimport {\n  backgroundTaskResponseSchema,\n  backgroundTaskStreamQuerySchema,\n  backgroundTaskStreamResponseSchema,\n  listBackgroundTaskResponseSchema,\n  listBackgroundTasksQuerySchema,\n  backgroundTaskIdPathParams,\n} from '../schemas/background-tasks';\nimport { createRoute } from '../server-adapter/routes/route-builder';\nimport { getContextResourceId } from './utils';\n\n/**\n * Resolves the resource filter for a background-task request. A resource-scoped caller\n * is pinned to its own resource and may not request another one; a privileged caller\n * (no resource in the request context) keeps the client-provided filter.\n */\nfunction resolveResourceScope(\n  requestContext: Parameters<typeof getContextResourceId>[0],\n  clientResourceId: string | undefined,\n): { resourceId: string | undefined; scoped: boolean } {\n  const contextResourceId = getContextResourceId(requestContext);\n  if (contextResourceId === undefined) return { resourceId: clientResourceId, scoped: false };\n  // An empty resource id must not be mistaken for a privileged (unscoped) caller, and\n  // storage filters ignore empty strings, so it cannot be scoped safely either.\n  if (contextResourceId === '') {\n    throw new HTTPException(403, { message: 'Access denied: authenticated resourceId is empty' });\n  }\n  if (clientResourceId !== undefined && clientResourceId !== contextResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: resourceId does not match the authenticated resource' });\n  }\n  return { resourceId: contextResourceId, scoped: true };\n}\n\nexport const BACKGROUND_TASK_STREAM_ROUTE = createRoute({\n  method: 'GET',\n  path: '/background-tasks/stream',\n  responseType: 'stream' as const,\n  streamFormat: 'sse' as const,\n  queryParamSchema: backgroundTaskStreamQuerySchema,\n  responseSchema: backgroundTaskStreamResponseSchema,\n  summary: 'Stream background task events via SSE',\n  description: 'Real-time Server-Sent Events stream of background task completion/failure events.',\n  tags: ['Background Tasks'],\n  requiresAuth: true,\n  handler: async ({\n    mastra,\n    agentId,\n    runId,\n    threadId,\n    resourceId: clientResourceId,\n    taskId,\n    abortSignal,\n    requestContext,\n  }) => {\n    const { resourceId, scoped } = resolveResourceScope(requestContext, clientResourceId);\n    const bgManager = mastra.backgroundTaskManager;\n    if (!bgManager) {\n      // Background tasks are not enabled — return an empty stream that stays\n      // open until the client disconnects. This avoids spamming the logs with\n      // false-positive errors when clients (e.g. the studio UI) optimistically\n      // subscribe to the stream.\n      return new ReadableStream({\n        start(controller) {\n          abortSignal?.addEventListener('abort', () => {\n            try {\n              controller.close();\n            } catch {\n              // Already closed\n            }\n          });\n        },\n      });\n    }\n\n    return bgManager.stream({ agentId, runId, threadId, resourceId, taskId, abortSignal, allResources: !scoped });\n  },\n});\n\nexport const LIST_BACKGROUND_TASKS_ROUTE = createRoute({\n  method: 'GET',\n  path: '/background-tasks',\n  responseType: 'json' as const,\n  queryParamSchema: listBackgroundTasksQuerySchema,\n  responseSchema: listBackgroundTaskResponseSchema,\n  summary: 'List background tasks',\n  description: 'Returns background tasks filtered by status, agent, run, etc.',\n  tags: ['Background Tasks'],\n  requiresAuth: true,\n  handler: async ({ mastra, requestContext, ...params }) => {\n    const { resourceId } = resolveResourceScope(requestContext, params.resourceId);\n    const bgManager = mastra.backgroundTaskManager;\n    if (!bgManager) {\n      // Background tasks not enabled — there are no tasks to return.\n      return { tasks: [], total: 0 };\n    }\n\n    return bgManager.listTasks({ ...params, resourceId });\n  },\n});\n\nexport const GET_BACKGROUND_TASK_ROUTE = createRoute({\n  method: 'GET',\n  path: '/background-tasks/:backgroundTaskId',\n  responseType: 'json' as const,\n  pathParamSchema: backgroundTaskIdPathParams,\n  responseSchema: backgroundTaskResponseSchema,\n  summary: 'Get a background task by ID',\n  description: 'Returns a background task by ID.',\n  tags: ['Background Tasks'],\n  requiresAuth: true,\n  handler: async ({ mastra, backgroundTaskId, requestContext }) => {\n    const { resourceId, scoped } = resolveResourceScope(requestContext, undefined);\n    const bgManager = mastra.backgroundTaskManager;\n    if (!bgManager) {\n      // Background tasks not enabled — the task can't exist.\n      throw new HTTPException(404, { message: 'Background task not found' });\n    }\n\n    const task = await bgManager.getTask(backgroundTaskId);\n    // Report another resource's task as missing so its existence is not disclosed.\n    if (!task || (scoped && task.resourceId !== resourceId)) {\n      throw new HTTPException(404, { message: 'Background task not found' });\n    }\n    return task;\n  },\n});\n"],"mappings":";;;;;;AAGA,MAAa,6BAA6BA,IAAAA,EAAE,KAAK;CAC/C;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAa,kCAAkCA,IAAAA,EAAE,OAAO;CACtD,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,OAAOA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAC9B,CAAC;AAED,MAAa,iCAAiCA,IAAAA,EAAE,KAAK;CAAC;CAAa;CAAa;CAAe;AAAa,CAAC;AAE7G,MAAa,iCAAiCA,IAAAA,EAAE,OAAO;CACrD,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQ,2BAA2B,SAAS;CAC5C,OAAOA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,UAAUA,IAAAA,EAAE,OAAO,KAAK,CAAC,CAAC,SAAS;CACnC,QAAQA,IAAAA,EAAE,OAAO,KAAK,CAAC,CAAC,SAAS;CACjC,cAAc,+BAA+B,SAAS;CACtD,SAAS,+BAA+B,SAAS;CACjD,gBAAgBA,IAAAA,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS;CACjD,MAAMC,eAAAA,iBAAiB,CAAC,CAAC,SAAS;CAClC,SAASA,eAAAA,iBAAiB,CAAC,CAAC,SAAS;AACvC,CAAC;AAED,MAAa,6BAA6BD,IAAAA,EAAE,OAAO,EACjD,kBAAkBA,IAAAA,EAAE,OAAO,EAC7B,CAAC;AAED,MAAa,+BAA+BA,IAAAA,EAAE,OAAO;CACnD,IAAIA,IAAAA,EAAE,OAAO;CACb,QAAQ;CACR,UAAUA,IAAAA,EAAE,OAAO;CACnB,YAAYA,IAAAA,EAAE,OAAO;CACrB,MAAMA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAGA,IAAAA,EAAE,QAAQ,CAAC;CACtC,SAASA,IAAAA,EAAE,OAAO;CAClB,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,OAAOA,IAAAA,EAAE,OAAO;CAChB,QAAQA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC7B,OAAOA,IAAAA,EAAE,OAAO;EAAE,SAASA,IAAAA,EAAE,OAAO;EAAG,OAAOA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAAE,CAAC,CAAC,CAAC,SAAS;CAChF,WAAWA,IAAAA,EAAE,KAAK;CAClB,WAAWA,IAAAA,EAAE,KAAK,CAAC,CAAC,SAAS;CAC7B,aAAaA,IAAAA,EAAE,KAAK,CAAC,CAAC,SAAS;CAC/B,YAAYA,IAAAA,EAAE,OAAO;CACrB,YAAYA,IAAAA,EAAE,OAAO;CACrB,WAAWA,IAAAA,EAAE,OAAO;CACpB,gBAAgBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;AACvC,CAAC;AAED,MAAa,mCAAmCA,IAAAA,EAAE,OAAO;CACvD,OAAOA,IAAAA,EAAE,MAAM,4BAA4B;CAC3C,OAAOA,IAAAA,EAAE,OAAO;AAClB,CAAC;AAED,MAAa,qCAAqCA,IAAAA,EAAE,QAAQ;;;;;;;;ACrD5D,SAAS,qBACP,gBACA,kBACqD;CACrD,MAAM,oBAAoBE,cAAAA,qBAAqB,cAAc;CAC7D,IAAI,sBAAsB,KAAA,GAAW,OAAO;EAAE,YAAY;EAAkB,QAAQ;CAAM;CAG1F,IAAI,sBAAsB,IACxB,MAAM,IAAIC,uBAAAA,cAAc,KAAK,EAAE,SAAS,mDAAmD,CAAC;CAE9F,IAAI,qBAAqB,KAAA,KAAa,qBAAqB,mBACzD,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,sEAAsE,CAAC;CAEjH,OAAO;EAAE,YAAY;EAAmB,QAAQ;CAAK;AACvD;AAEA,MAAa,+BAA+BC,sBAAAA,YAAY;CACtD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,cAAc;CACd,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,kBAAkB;CACzB,cAAc;CACd,SAAS,OAAO,EACd,QACA,SACA,OACA,UACA,YAAY,kBACZ,QACA,aACA,qBACI;EACJ,MAAM,EAAE,YAAY,WAAW,qBAAqB,gBAAgB,gBAAgB;EACpF,MAAM,YAAY,OAAO;EACzB,IAAI,CAAC,WAKH,OAAO,IAAI,eAAe,EACxB,MAAM,YAAY;GAChB,aAAa,iBAAiB,eAAe;IAC3C,IAAI;KACF,WAAW,MAAM;IACnB,QAAQ,CAER;GACF,CAAC;EACH,EACF,CAAC;EAGH,OAAO,UAAU,OAAO;GAAE;GAAS;GAAO;GAAU;GAAY;GAAQ;GAAa,cAAc,CAAC;EAAO,CAAC;CAC9G;AACF,CAAC;AAED,MAAa,8BAA8BA,sBAAAA,YAAY;CACrD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,kBAAkB;CACzB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,gBAAgB,GAAG,aAAa;EACxD,MAAM,EAAE,eAAe,qBAAqB,gBAAgB,OAAO,UAAU;EAC7E,MAAM,YAAY,OAAO;EACzB,IAAI,CAAC,WAEH,OAAO;GAAE,OAAO,CAAC;GAAG,OAAO;EAAE;EAG/B,OAAO,UAAU,UAAU;GAAE,GAAG;GAAQ;EAAW,CAAC;CACtD;AACF,CAAC;AAED,MAAa,4BAA4BA,sBAAAA,YAAY;CACnD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,kBAAkB;CACzB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,kBAAkB,qBAAqB;EAC/D,MAAM,EAAE,YAAY,WAAW,qBAAqB,gBAAgB,KAAA,CAAS;EAC7E,MAAM,YAAY,OAAO;EACzB,IAAI,CAAC,WAEH,MAAM,IAAID,uBAAAA,cAAc,KAAK,EAAE,SAAS,4BAA4B,CAAC;EAGvE,MAAM,OAAO,MAAM,UAAU,QAAQ,gBAAgB;EAErD,IAAI,CAAC,QAAS,UAAU,KAAK,eAAe,YAC1C,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,4BAA4B,CAAC;EAEvE,OAAO;CACT;AACF,CAAC"}

package/dist/{background-tasks-DgskLon8.js → background-tasks-_e2S8LLH.js}

@@ -1,6 +1,7 @@
 import { t as HTTPException } from "./http-exception-CyfxZB6W.js";
 import { c as paginationNumber } from "./common-Y30XtCyr.js";
 import { n as createRoute } from "./route-builder-lBil8Cvo.js";
+import { n as getContextResourceId } from "./utils-GVYTDbr2.js";
 import { z as z$1 } from "zod";
 //#region src/server/schemas/background-tasks.ts
 const backgroundTaskStatusSchema = z$1.enum([
@@ -69,20 +70,40 @@ const listBackgroundTaskResponseSchema = z$1.object({
 	tasks: z$1.array(backgroundTaskResponseSchema),
 	total: z$1.number()
 });
+const backgroundTaskStreamResponseSchema = z$1.unknown();
 //#endregion
 //#region src/server/handlers/background-tasks.ts
+/**
+* Resolves the resource filter for a background-task request. A resource-scoped caller
+* is pinned to its own resource and may not request another one; a privileged caller
+* (no resource in the request context) keeps the client-provided filter.
+*/
+function resolveResourceScope(requestContext, clientResourceId) {
+	const contextResourceId = getContextResourceId(requestContext);
+	if (contextResourceId === void 0) return {
+		resourceId: clientResourceId,
+		scoped: false
+	};
+	if (contextResourceId === "") throw new HTTPException(403, { message: "Access denied: authenticated resourceId is empty" });
+	if (clientResourceId !== void 0 && clientResourceId !== contextResourceId) throw new HTTPException(403, { message: "Access denied: resourceId does not match the authenticated resource" });
+	return {
+		resourceId: contextResourceId,
+		scoped: true
+	};
+}
 const BACKGROUND_TASK_STREAM_ROUTE = createRoute({
 	method: "GET",
 	path: "/background-tasks/stream",
 	responseType: "stream",
 	streamFormat: "sse",
 	queryParamSchema: backgroundTaskStreamQuerySchema,
-	responseSchema: z$1.unknown(),
+	responseSchema: backgroundTaskStreamResponseSchema,
 	summary: "Stream background task events via SSE",
 	description: "Real-time Server-Sent Events stream of background task completion/failure events.",
 	tags: ["Background Tasks"],
 	requiresAuth: true,
-	handler: async ({ mastra, agentId, runId, threadId, resourceId, taskId, abortSignal }) => {
+	handler: async ({ mastra, agentId, runId, threadId, resourceId: clientResourceId, taskId, abortSignal, requestContext }) => {
+		const { resourceId, scoped } = resolveResourceScope(requestContext, clientResourceId);
 		const bgManager = mastra.backgroundTaskManager;
 		if (!bgManager) return new ReadableStream({ start(controller) {
 			abortSignal?.addEventListener("abort", () => {
@@ -97,7 +118,8 @@ const BACKGROUND_TASK_STREAM_ROUTE = createRoute({
 			threadId,
 			resourceId,
 			taskId,
-			abortSignal
+			abortSignal,
+			allResources: !scoped
 		});
 	}
 });
@@ -111,13 +133,17 @@ const LIST_BACKGROUND_TASKS_ROUTE = createRoute({
 	description: "Returns background tasks filtered by status, agent, run, etc.",
 	tags: ["Background Tasks"],
 	requiresAuth: true,
-	handler: async ({ mastra, ...params }) => {
+	handler: async ({ mastra, requestContext, ...params }) => {
+		const { resourceId } = resolveResourceScope(requestContext, params.resourceId);
 		const bgManager = mastra.backgroundTaskManager;
 		if (!bgManager) return {
 			tasks: [],
 			total: 0
 		};
-		return bgManager.listTasks(params);
+		return bgManager.listTasks({
+			...params,
+			resourceId
+		});
 	}
 });
 const GET_BACKGROUND_TASK_ROUTE = createRoute({
@@ -130,15 +156,16 @@ const GET_BACKGROUND_TASK_ROUTE = createRoute({
 	description: "Returns a background task by ID.",
 	tags: ["Background Tasks"],
 	requiresAuth: true,
-	handler: async ({ mastra, backgroundTaskId }) => {
+	handler: async ({ mastra, backgroundTaskId, requestContext }) => {
+		const { resourceId, scoped } = resolveResourceScope(requestContext, void 0);
 		const bgManager = mastra.backgroundTaskManager;
 		if (!bgManager) throw new HTTPException(404, { message: "Background task not found" });
 		const task = await bgManager.getTask(backgroundTaskId);
-		if (!task) throw new HTTPException(404, { message: "Background task not found" });
+		if (!task || scoped && task.resourceId !== resourceId) throw new HTTPException(404, { message: "Background task not found" });
 		return task;
 	}
 });
 //#endregion
 export { GET_BACKGROUND_TASK_ROUTE as n, LIST_BACKGROUND_TASKS_ROUTE as r, BACKGROUND_TASK_STREAM_ROUTE as t };
 
-//# sourceMappingURL=background-tasks-DgskLon8.js.map
+//# sourceMappingURL=background-tasks-_e2S8LLH.js.map

package/dist/background-tasks-_e2S8LLH.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"background-tasks-_e2S8LLH.js","names":["z"],"sources":["../src/server/schemas/background-tasks.ts","../src/server/handlers/background-tasks.ts"],"sourcesContent":["import { z } from 'zod';\nimport { paginationNumber } from './common';\n\nexport const backgroundTaskStatusSchema = z.enum([\n  'pending',\n  'running',\n  'suspended',\n  'completed',\n  'failed',\n  'cancelled',\n  'timed_out',\n]);\n\nexport const backgroundTaskStreamQuerySchema = z.object({\n  agentId: z.string().optional(),\n  runId: z.string().optional(),\n  threadId: z.string().optional(),\n  resourceId: z.string().optional(),\n  taskId: z.string().optional(),\n});\n\nexport const backgroundTaskDateColumnSchema = z.enum(['createdAt', 'startedAt', 'suspendedAt', 'completedAt']);\n\nexport const listBackgroundTasksQuerySchema = z.object({\n  agentId: z.string().optional(),\n  status: backgroundTaskStatusSchema.optional(),\n  runId: z.string().optional(),\n  threadId: z.string().optional(),\n  resourceId: z.string().optional(),\n  toolName: z.string().optional(),\n  toolCallId: z.string().optional(),\n  fromDate: z.coerce.date().optional(),\n  toDate: z.coerce.date().optional(),\n  dateFilterBy: backgroundTaskDateColumnSchema.optional(),\n  orderBy: backgroundTaskDateColumnSchema.optional(),\n  orderDirection: z.enum(['asc', 'desc']).optional(),\n  page: paginationNumber().optional(),\n  perPage: paginationNumber().optional(),\n});\n\nexport const backgroundTaskIdPathParams = z.object({\n  backgroundTaskId: z.string(),\n});\n\nexport const backgroundTaskResponseSchema = z.object({\n  id: z.string(),\n  status: backgroundTaskStatusSchema,\n  toolName: z.string(),\n  toolCallId: z.string(),\n  args: z.record(z.string(), z.unknown()),\n  agentId: z.string(),\n  threadId: z.string().optional(),\n  resourceId: z.string().optional(),\n  runId: z.string(),\n  result: z.unknown().optional(),\n  error: z.object({ message: z.string(), stack: z.string().optional() }).optional(),\n  createdAt: z.date(),\n  startedAt: z.date().optional(),\n  completedAt: z.date().optional(),\n  retryCount: z.number(),\n  maxRetries: z.number(),\n  timeoutMs: z.number(),\n  suspendPayload: z.unknown().optional(),\n});\n\nexport const listBackgroundTaskResponseSchema = z.object({\n  tasks: z.array(backgroundTaskResponseSchema),\n  total: z.number(),\n});\n\nexport const backgroundTaskStreamResponseSchema = z.unknown();\n","import { HTTPException } from '../http-exception';\nimport {\n  backgroundTaskResponseSchema,\n  backgroundTaskStreamQuerySchema,\n  backgroundTaskStreamResponseSchema,\n  listBackgroundTaskResponseSchema,\n  listBackgroundTasksQuerySchema,\n  backgroundTaskIdPathParams,\n} from '../schemas/background-tasks';\nimport { createRoute } from '../server-adapter/routes/route-builder';\nimport { getContextResourceId } from './utils';\n\n/**\n * Resolves the resource filter for a background-task request. A resource-scoped caller\n * is pinned to its own resource and may not request another one; a privileged caller\n * (no resource in the request context) keeps the client-provided filter.\n */\nfunction resolveResourceScope(\n  requestContext: Parameters<typeof getContextResourceId>[0],\n  clientResourceId: string | undefined,\n): { resourceId: string | undefined; scoped: boolean } {\n  const contextResourceId = getContextResourceId(requestContext);\n  if (contextResourceId === undefined) return { resourceId: clientResourceId, scoped: false };\n  // An empty resource id must not be mistaken for a privileged (unscoped) caller, and\n  // storage filters ignore empty strings, so it cannot be scoped safely either.\n  if (contextResourceId === '') {\n    throw new HTTPException(403, { message: 'Access denied: authenticated resourceId is empty' });\n  }\n  if (clientResourceId !== undefined && clientResourceId !== contextResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: resourceId does not match the authenticated resource' });\n  }\n  return { resourceId: contextResourceId, scoped: true };\n}\n\nexport const BACKGROUND_TASK_STREAM_ROUTE = createRoute({\n  method: 'GET',\n  path: '/background-tasks/stream',\n  responseType: 'stream' as const,\n  streamFormat: 'sse' as const,\n  queryParamSchema: backgroundTaskStreamQuerySchema,\n  responseSchema: backgroundTaskStreamResponseSchema,\n  summary: 'Stream background task events via SSE',\n  description: 'Real-time Server-Sent Events stream of background task completion/failure events.',\n  tags: ['Background Tasks'],\n  requiresAuth: true,\n  handler: async ({\n    mastra,\n    agentId,\n    runId,\n    threadId,\n    resourceId: clientResourceId,\n    taskId,\n    abortSignal,\n    requestContext,\n  }) => {\n    const { resourceId, scoped } = resolveResourceScope(requestContext, clientResourceId);\n    const bgManager = mastra.backgroundTaskManager;\n    if (!bgManager) {\n      // Background tasks are not enabled — return an empty stream that stays\n      // open until the client disconnects. This avoids spamming the logs with\n      // false-positive errors when clients (e.g. the studio UI) optimistically\n      // subscribe to the stream.\n      return new ReadableStream({\n        start(controller) {\n          abortSignal?.addEventListener('abort', () => {\n            try {\n              controller.close();\n            } catch {\n              // Already closed\n            }\n          });\n        },\n      });\n    }\n\n    return bgManager.stream({ agentId, runId, threadId, resourceId, taskId, abortSignal, allResources: !scoped });\n  },\n});\n\nexport const LIST_BACKGROUND_TASKS_ROUTE = createRoute({\n  method: 'GET',\n  path: '/background-tasks',\n  responseType: 'json' as const,\n  queryParamSchema: listBackgroundTasksQuerySchema,\n  responseSchema: listBackgroundTaskResponseSchema,\n  summary: 'List background tasks',\n  description: 'Returns background tasks filtered by status, agent, run, etc.',\n  tags: ['Background Tasks'],\n  requiresAuth: true,\n  handler: async ({ mastra, requestContext, ...params }) => {\n    const { resourceId } = resolveResourceScope(requestContext, params.resourceId);\n    const bgManager = mastra.backgroundTaskManager;\n    if (!bgManager) {\n      // Background tasks not enabled — there are no tasks to return.\n      return { tasks: [], total: 0 };\n    }\n\n    return bgManager.listTasks({ ...params, resourceId });\n  },\n});\n\nexport const GET_BACKGROUND_TASK_ROUTE = createRoute({\n  method: 'GET',\n  path: '/background-tasks/:backgroundTaskId',\n  responseType: 'json' as const,\n  pathParamSchema: backgroundTaskIdPathParams,\n  responseSchema: backgroundTaskResponseSchema,\n  summary: 'Get a background task by ID',\n  description: 'Returns a background task by ID.',\n  tags: ['Background Tasks'],\n  requiresAuth: true,\n  handler: async ({ mastra, backgroundTaskId, requestContext }) => {\n    const { resourceId, scoped } = resolveResourceScope(requestContext, undefined);\n    const bgManager = mastra.backgroundTaskManager;\n    if (!bgManager) {\n      // Background tasks not enabled — the task can't exist.\n      throw new HTTPException(404, { message: 'Background task not found' });\n    }\n\n    const task = await bgManager.getTask(backgroundTaskId);\n    // Report another resource's task as missing so its existence is not disclosed.\n    if (!task || (scoped && task.resourceId !== resourceId)) {\n      throw new HTTPException(404, { message: 'Background task not found' });\n    }\n    return task;\n  },\n});\n"],"mappings":";;;;;;AAGA,MAAa,6BAA6BA,IAAE,KAAK;CAC/C;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAa,kCAAkCA,IAAE,OAAO;CACtD,SAASA,IAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,OAAOA,IAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,UAAUA,IAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,YAAYA,IAAE,OAAO,CAAC,CAAC,SAAS;CAChC,QAAQA,IAAE,OAAO,CAAC,CAAC,SAAS;AAC9B,CAAC;AAED,MAAa,iCAAiCA,IAAE,KAAK;CAAC;CAAa;CAAa;CAAe;AAAa,CAAC;AAE7G,MAAa,iCAAiCA,IAAE,OAAO;CACrD,SAASA,IAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQ,2BAA2B,SAAS;CAC5C,OAAOA,IAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,UAAUA,IAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,YAAYA,IAAE,OAAO,CAAC,CAAC,SAAS;CAChC,UAAUA,IAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,YAAYA,IAAE,OAAO,CAAC,CAAC,SAAS;CAChC,UAAUA,IAAE,OAAO,KAAK,CAAC,CAAC,SAAS;CACnC,QAAQA,IAAE,OAAO,KAAK,CAAC,CAAC,SAAS;CACjC,cAAc,+BAA+B,SAAS;CACtD,SAAS,+BAA+B,SAAS;CACjD,gBAAgBA,IAAE,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS;CACjD,MAAM,iBAAiB,CAAC,CAAC,SAAS;CAClC,SAAS,iBAAiB,CAAC,CAAC,SAAS;AACvC,CAAC;AAED,MAAa,6BAA6BA,IAAE,OAAO,EACjD,kBAAkBA,IAAE,OAAO,EAC7B,CAAC;AAED,MAAa,+BAA+BA,IAAE,OAAO;CACnD,IAAIA,IAAE,OAAO;CACb,QAAQ;CACR,UAAUA,IAAE,OAAO;CACnB,YAAYA,IAAE,OAAO;CACrB,MAAMA,IAAE,OAAOA,IAAE,OAAO,GAAGA,IAAE,QAAQ,CAAC;CACtC,SAASA,IAAE,OAAO;CAClB,UAAUA,IAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,YAAYA,IAAE,OAAO,CAAC,CAAC,SAAS;CAChC,OAAOA,IAAE,OAAO;CAChB,QAAQA,IAAE,QAAQ,CAAC,CAAC,SAAS;CAC7B,OAAOA,IAAE,OAAO;EAAE,SAASA,IAAE,OAAO;EAAG,OAAOA,IAAE,OAAO,CAAC,CAAC,SAAS;CAAE,CAAC,CAAC,CAAC,SAAS;CAChF,WAAWA,IAAE,KAAK;CAClB,WAAWA,IAAE,KAAK,CAAC,CAAC,SAAS;CAC7B,aAAaA,IAAE,KAAK,CAAC,CAAC,SAAS;CAC/B,YAAYA,IAAE,OAAO;CACrB,YAAYA,IAAE,OAAO;CACrB,WAAWA,IAAE,OAAO;CACpB,gBAAgBA,IAAE,QAAQ,CAAC,CAAC,SAAS;AACvC,CAAC;AAED,MAAa,mCAAmCA,IAAE,OAAO;CACvD,OAAOA,IAAE,MAAM,4BAA4B;CAC3C,OAAOA,IAAE,OAAO;AAClB,CAAC;AAED,MAAa,qCAAqCA,IAAE,QAAQ;;;;;;;;ACrD5D,SAAS,qBACP,gBACA,kBACqD;CACrD,MAAM,oBAAoB,qBAAqB,cAAc;CAC7D,IAAI,sBAAsB,KAAA,GAAW,OAAO;EAAE,YAAY;EAAkB,QAAQ;CAAM;CAG1F,IAAI,sBAAsB,IACxB,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,mDAAmD,CAAC;CAE9F,IAAI,qBAAqB,KAAA,KAAa,qBAAqB,mBACzD,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,sEAAsE,CAAC;CAEjH,OAAO;EAAE,YAAY;EAAmB,QAAQ;CAAK;AACvD;AAEA,MAAa,+BAA+B,YAAY;CACtD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,cAAc;CACd,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,kBAAkB;CACzB,cAAc;CACd,SAAS,OAAO,EACd,QACA,SACA,OACA,UACA,YAAY,kBACZ,QACA,aACA,qBACI;EACJ,MAAM,EAAE,YAAY,WAAW,qBAAqB,gBAAgB,gBAAgB;EACpF,MAAM,YAAY,OAAO;EACzB,IAAI,CAAC,WAKH,OAAO,IAAI,eAAe,EACxB,MAAM,YAAY;GAChB,aAAa,iBAAiB,eAAe;IAC3C,IAAI;KACF,WAAW,MAAM;IACnB,QAAQ,CAER;GACF,CAAC;EACH,EACF,CAAC;EAGH,OAAO,UAAU,OAAO;GAAE;GAAS;GAAO;GAAU;GAAY;GAAQ;GAAa,cAAc,CAAC;EAAO,CAAC;CAC9G;AACF,CAAC;AAED,MAAa,8BAA8B,YAAY;CACrD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,kBAAkB;CACzB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,gBAAgB,GAAG,aAAa;EACxD,MAAM,EAAE,eAAe,qBAAqB,gBAAgB,OAAO,UAAU;EAC7E,MAAM,YAAY,OAAO;EACzB,IAAI,CAAC,WAEH,OAAO;GAAE,OAAO,CAAC;GAAG,OAAO;EAAE;EAG/B,OAAO,UAAU,UAAU;GAAE,GAAG;GAAQ;EAAW,CAAC;CACtD;AACF,CAAC;AAED,MAAa,4BAA4B,YAAY;CACnD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,kBAAkB;CACzB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,kBAAkB,qBAAqB;EAC/D,MAAM,EAAE,YAAY,WAAW,qBAAqB,gBAAgB,KAAA,CAAS;EAC7E,MAAM,YAAY,OAAO;EACzB,IAAI,CAAC,WAEH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,4BAA4B,CAAC;EAGvE,MAAM,OAAO,MAAM,UAAU,QAAQ,gBAAgB;EAErD,IAAI,CAAC,QAAS,UAAU,KAAK,eAAe,YAC1C,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,4BAA4B,CAAC;EAEvE,OAAO;CACT;AACF,CAAC"}

package/dist/{builder-registry-CEx2-J6_.js → builder-registry-6A0b4EwP.js}

@@ -1,6 +1,6 @@
 import { t as HTTPException } from "./http-exception-CyfxZB6W.js";
 import { n as createRoute } from "./route-builder-lBil8Cvo.js";
-import { c as toSlug } from "./utils-DTgkpEdc.js";
+import { c as toSlug } from "./utils-BpQY-tBr.js";
 import { handleError } from "./server/handlers/error.js";
 import { H as skillsShPreviewResponseSchema, K as skillsShSearchResponseSchema, z as skillsShListResponseSchema } from "./workspace-4dBGFdV2.js";
 import { getCallerAuthorId } from "./server/handlers/authorship.js";
@@ -351,4 +351,4 @@ const BUILDER_REGISTRY_INSTALL_ROUTE = createRoute({
 //#endregion
 export { LIST_BUILDER_REGISTRIES_ROUTE as a, BUILDER_REGISTRY_SEARCH_ROUTE as i, BUILDER_REGISTRY_POPULAR_ROUTE as n, BUILDER_REGISTRY_PREVIEW_ROUTE as r, BUILDER_REGISTRY_INSTALL_ROUTE as t };
 
-//# sourceMappingURL=builder-registry-CEx2-J6_.js.map
+//# sourceMappingURL=builder-registry-6A0b4EwP.js.map

package/dist/{builder-registry-CEx2-J6_.js.map → builder-registry-6A0b4EwP.js.map}

@@ -1 +1 @@
-{"version":3,"file":"builder-registry-CEx2-J6_.js","names":[],"sources":["../src/server/schemas/builder-registry.ts","../src/server/handlers/builder-registry.ts"],"sourcesContent":["/**\n * Builder Registry Schemas\n *\n * Schemas for the Agent Builder skill registry routes. These are distinct from\n * the workspace skills.sh proxy schemas because:\n *   - Builder routes are not scoped to a workspace.\n *   - Builder install does not accept a `mount` field.\n *   - Builder install body carries visibility + the resolved registry id.\n *   - Builder install response returns the created stored skill id.\n *\n * The upstream skills.sh proxy response shapes are reused via the shared\n * `skillsShSearchResponseSchema`, `skillsShListResponseSchema`, and\n * `skillsShPreviewResponseSchema` since the wire shape from skills.sh is\n * registry-independent.\n */\n\nimport { z } from 'zod/v4';\n\n// =============================================================================\n// Registry list\n// =============================================================================\n\n/** Single entry in the registries list. */\nexport const builderRegistryEntrySchema = z.object({\n  id: z.literal('skills-sh').describe('Stable registry identifier'),\n  enabled: z.boolean().describe('Whether this registry is enabled in the running deployment'),\n  label: z.string().describe('Human-readable registry name'),\n});\n\n/** Response for `GET /editor/builder/registries`. */\nexport const builderRegistriesResponseSchema = z.object({\n  registries: z.array(builderRegistryEntrySchema),\n});\n\n// =============================================================================\n// Search / popular / preview\n// =============================================================================\n\n/** Path params used by every per-registry route. */\nexport const builderRegistryPathParams = z.object({\n  registryId: z.string().describe('Registry identifier (e.g. \"skills-sh\")'),\n});\n\nexport const builderRegistrySearchQuerySchema = z.object({\n  q: z.string().describe('Search query'),\n  limit: z.coerce.number().int().min(1).max(100).optional().default(10).describe('Maximum number of results (1-100)'),\n});\n\nexport const builderRegistryPopularQuerySchema = z\n  .object({\n    limit: z.coerce.number().int().min(1).max(100).optional().default(10).describe('Maximum number of results (1-100)'),\n    offset: z.coerce\n      .number()\n      .int()\n      .min(0)\n      .optional()\n      .default(0)\n      .describe('Offset for pagination (must be a multiple of `limit`)'),\n  })\n  .refine(args => args.offset % args.limit === 0, {\n    message: 'offset must be a multiple of limit (the upstream registry pages by `limit`)',\n    path: ['offset'],\n  });\n\nexport const builderRegistryPreviewQuerySchema = z.object({\n  owner: z.string().describe('GitHub repository owner'),\n  repo: z.string().describe('GitHub repository name'),\n  path: z.string().describe('Skill name within repo'),\n});\n\n// =============================================================================\n// Install\n// =============================================================================\n\n/**\n * Body for `POST /editor/builder/registries/:registryId/install`.\n *\n * Visibility behaves like the standard stored-skill create flow: optional,\n * defaults to private when the caller is authenticated.\n */\nexport const builderRegistryInstallBodySchema = z.object({\n  owner: z.string().describe('GitHub repository owner'),\n  repo: z.string().describe('GitHub repository name'),\n  skillName: z.string().describe('Skill name from the registry'),\n  visibility: z.enum(['private', 'public']).optional().describe('Visibility for the new stored skill'),\n});\n\n/** Response for the install route. Mirrors stored-skill identity fields. */\nexport const builderRegistryInstallResponseSchema = z.object({\n  storedSkillId: z.string().describe('Id of the newly created stored skill'),\n  name: z.string().describe('Resolved skill name'),\n  filesWritten: z.number().describe('Number of files materialized into the skill version snapshot'),\n});\n\nexport type BuilderRegistryEntry = z.infer<typeof builderRegistryEntrySchema>;\nexport type BuilderRegistriesResponse = z.infer<typeof builderRegistriesResponseSchema>;\nexport type BuilderRegistryInstallBody = z.infer<typeof builderRegistryInstallBodySchema>;\nexport type BuilderRegistryInstallResponse = z.infer<typeof builderRegistryInstallResponseSchema>;\n","/**\n * Builder Registry Handlers\n *\n * Routes that let admins browse and install skills from configured external\n * registries (currently just skills.sh) directly into the Builder's stored\n * skills DB. Distinct from the workspace skills.sh routes, which write to a\n * workspace filesystem and never touch storage.\n *\n * Registry availability is driven by `AgentBuilderOptions.registries`. When\n * the requested registry is disabled (or the builder is missing entirely),\n * the routes 404 instead of leaking the surface.\n */\n\nimport type { Mastra } from '@mastra/core';\nimport type { StorageSkillFileNode } from '@mastra/core/storage';\n\nimport { HTTPException } from '../http-exception';\nimport {\n  builderRegistriesResponseSchema,\n  builderRegistryInstallBodySchema,\n  builderRegistryInstallResponseSchema,\n  builderRegistryPathParams,\n  builderRegistryPopularQuerySchema,\n  builderRegistryPreviewQuerySchema,\n  builderRegistrySearchQuerySchema,\n} from '../schemas/builder-registry';\nimport {\n  skillsShListResponseSchema,\n  skillsShPreviewResponseSchema,\n  skillsShSearchResponseSchema,\n} from '../schemas/workspace';\nimport { createRoute } from '../server-adapter/routes/route-builder';\nimport { toSlug } from '../utils';\nimport { getCallerAuthorId } from './authorship';\nimport { handleError } from './error';\nimport {\n  assertSafeFilePath,\n  assertSafeSkillName,\n  fetchSkillFiles,\n  getPopularSkillsSh,\n  previewSkillsSh,\n  searchSkillsSh,\n} from './skills-sh-shared';\n\n// =============================================================================\n// Registry resolution\n// =============================================================================\n\n/** Stable identifiers + display labels for every supported registry. */\nconst REGISTRY_LABELS: Record<string, string> = {\n  'skills-sh': 'skills.sh',\n};\n\ninterface RegistryStatus {\n  id: 'skills-sh';\n  enabled: boolean;\n  label: string;\n}\n\n/**\n * Resolve which registries are enabled for the running deployment by reading\n * the builder's `registries` config. Returns a list with all known registries\n * (so the frontend can render an empty/disabled state) plus their enabled\n * flag.\n */\nasync function resolveRegistries(mastra: Mastra): Promise<RegistryStatus[]> {\n  const editor = mastra.getEditor();\n  if (!editor || typeof editor.resolveBuilder !== 'function') {\n    return [{ id: 'skills-sh', enabled: false, label: REGISTRY_LABELS['skills-sh']! }];\n  }\n  const builder = await editor.resolveBuilder();\n  const registries = builder?.getRegistries?.();\n  return [\n    {\n      id: 'skills-sh',\n      enabled: registries?.skillsSh?.enabled === true,\n      label: REGISTRY_LABELS['skills-sh']!,\n    },\n  ];\n}\n\n/**\n * Hard-gate: throws 404 when the requested registry is unknown or disabled.\n * Mirrors `requireBuilderFeature` semantics — no surface leak for OFF registries.\n */\nasync function requireEnabledRegistry(mastra: Mastra, registryId: string): Promise<void> {\n  const list = await resolveRegistries(mastra);\n  const match = list.find(r => r.id === registryId);\n  if (!match || !match.enabled) {\n    throw new HTTPException(404, { message: 'Registry not found' });\n  }\n}\n\n// =============================================================================\n// File-tree helpers\n// =============================================================================\n\n/**\n * Convert a flat list of `{ path, content, encoding }` entries into the\n * `StorageSkillFileNode` tree shape expected by the stored-skills create path.\n *\n * Each path is validated via `assertSafeFilePath` to prevent traversal from\n * upstream-controlled responses. Folder nodes are created on demand.\n */\nfunction buildFileTree(\n  files: Array<{ path: string; content: string; encoding: 'utf-8' | 'base64' }>,\n): StorageSkillFileNode[] {\n  const root: StorageSkillFileNode[] = [];\n\n  for (const file of files) {\n    const safePath = assertSafeFilePath(file.path);\n    const segments = safePath.split('/').filter(Boolean);\n    if (segments.length === 0) continue;\n\n    let cursor = root;\n    for (let i = 0; i < segments.length - 1; i++) {\n      const segment = segments[i]!;\n      let folder = cursor.find(node => node.type === 'folder' && node.name === segment);\n      if (!folder) {\n        folder = { name: segment, type: 'folder', children: [] };\n        cursor.push(folder);\n      }\n      if (!folder.children) folder.children = [];\n      cursor = folder.children;\n    }\n\n    const fileName = segments[segments.length - 1]!;\n    const content = file.encoding === 'base64' ? Buffer.from(file.content, 'base64').toString('utf-8') : file.content;\n    cursor.push({ name: fileName, type: 'file', content });\n  }\n\n  return root;\n}\n\n/**\n * Locally-bound SKILL.md frontmatter parser.\n *\n * Mirrors `parseSkillSnapshotFromFiles` from `@mastra/core/workspace`, but\n * inlined here because the server package's `@mastra/core` peer floor\n * (>=1.32.0) predates that helper. Once the floor is bumped to a release\n * containing the helper, this can be replaced by the shared core import.\n *\n * Only SKILL.md is consulted — frontmatter is split from the body using a\n * minimal YAML key:value reader sufficient for the fields registries\n * actually use (name, description). The body is everything after the\n * second `---` line, trimmed.\n */\ntype ParsedSkillSnapshot = {\n  name?: string;\n  description?: string;\n  instructions: string;\n};\n\nfunction parseSkillSnapshot(\n  files: Array<{ path: string; content: string; encoding: 'utf-8' | 'base64' }>,\n): ParsedSkillSnapshot | null {\n  const skillMd = files.find(f => f.path === 'SKILL.md');\n  if (!skillMd) return null;\n\n  const raw =\n    skillMd.encoding === 'base64' ? Buffer.from(skillMd.content, 'base64').toString('utf-8') : skillMd.content;\n\n  const fmMatch = raw.match(/^---\\r?\\n([\\s\\S]*?)\\r?\\n---\\r?\\n?([\\s\\S]*)$/);\n  if (!fmMatch) {\n    return { instructions: raw.trim() };\n  }\n\n  const fmBlock = fmMatch[1] ?? '';\n  const body = fmMatch[2] ?? '';\n  const frontmatter: Record<string, string> = {};\n  for (const line of fmBlock.split(/\\r?\\n/)) {\n    const m = line.match(/^([A-Za-z0-9_-]+)\\s*:\\s*(.*)$/);\n    if (!m) continue;\n    const key = m[1];\n    const value = m[2] ?? '';\n    if (!key) continue;\n    // Strip surrounding quotes, leave the rest as-is. Registry SKILL.md\n    // frontmatter is consistently flat string fields in practice.\n    frontmatter[key] = value.trim().replace(/^[\"'](.*)[\"']$/, '$1');\n  }\n\n  return {\n    name: frontmatter.name,\n    description: frontmatter.description,\n    instructions: body.trim(),\n  };\n}\n\n// =============================================================================\n// Routes\n// =============================================================================\n\n/**\n * GET /editor/builder/registries\n *\n * Lists every known registry and whether it's enabled in this deployment.\n * Used by the Builder UI to decide whether to show the \"Browse registry\"\n * entry point at all.\n */\nexport const LIST_BUILDER_REGISTRIES_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/builder/registries',\n  responseType: 'json',\n  responseSchema: builderRegistriesResponseSchema,\n  summary: 'List available skill registries',\n  description: 'Returns the configured external skill registries and their enabled state.',\n  tags: ['Editor'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:read',\n  handler: async ({ mastra }) => {\n    try {\n      const registries = await resolveRegistries(mastra);\n      return { registries };\n    } catch (error) {\n      return handleError(error, 'Error listing builder registries');\n    }\n  },\n});\n\n/**\n * GET /editor/builder/registries/:registryId/search\n *\n * Proxies a search query to the underlying registry. Currently only\n * registryId=\"skills-sh\" is supported.\n */\nexport const BUILDER_REGISTRY_SEARCH_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/builder/registries/:registryId/search',\n  responseType: 'json',\n  pathParamSchema: builderRegistryPathParams,\n  queryParamSchema: builderRegistrySearchQuerySchema,\n  responseSchema: skillsShSearchResponseSchema,\n  summary: 'Search skills in a registry',\n  description: 'Proxies a search request to the configured registry to avoid CORS issues.',\n  tags: ['Editor', 'Skills'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:read',\n  handler: async ({ mastra, registryId, q, limit }) => {\n    try {\n      await requireEnabledRegistry(mastra, registryId);\n      return await searchSkillsSh({ q, limit });\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      return handleError(error, 'Error searching registry');\n    }\n  },\n});\n\n/**\n * GET /editor/builder/registries/:registryId/popular\n *\n * Returns the most popular skills in a registry.\n */\nexport const BUILDER_REGISTRY_POPULAR_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/builder/registries/:registryId/popular',\n  responseType: 'json',\n  pathParamSchema: builderRegistryPathParams,\n  queryParamSchema: builderRegistryPopularQuerySchema,\n  responseSchema: skillsShListResponseSchema,\n  summary: 'Get popular skills from a registry',\n  description: 'Proxies a popular-skills request to the configured registry to avoid CORS issues.',\n  tags: ['Editor', 'Skills'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:read',\n  handler: async ({ mastra, registryId, limit, offset }) => {\n    try {\n      await requireEnabledRegistry(mastra, registryId);\n      return await getPopularSkillsSh({ limit, offset });\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      return handleError(error, 'Error fetching popular skills');\n    }\n  },\n});\n\n/**\n * GET /editor/builder/registries/:registryId/preview\n *\n * Returns the rendered SKILL.md content for a single skill in the registry.\n */\nexport const BUILDER_REGISTRY_PREVIEW_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/builder/registries/:registryId/preview',\n  responseType: 'json',\n  pathParamSchema: builderRegistryPathParams,\n  queryParamSchema: builderRegistryPreviewQuerySchema,\n  responseSchema: skillsShPreviewResponseSchema,\n  summary: 'Preview a skill from a registry',\n  description: 'Fetches the SKILL.md content for a single skill in the configured registry.',\n  tags: ['Editor', 'Skills'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:read',\n  handler: async ({ mastra, registryId, owner, repo, path: skillName }) => {\n    try {\n      await requireEnabledRegistry(mastra, registryId);\n      return await previewSkillsSh({ owner, repo, skillName });\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      return handleError(error, 'Error fetching skill preview');\n    }\n  },\n});\n\n/**\n * POST /editor/builder/registries/:registryId/install\n *\n * Fetches the full file tree for a skill from the registry, parses the\n * SKILL.md frontmatter for name/description, and persists everything as a\n * new stored skill. The registry origin is recorded under `metadata.origin`\n * so the UI can surface \"imported from skills.sh\" badges and re-resolve the\n * source later.\n *\n * Collisions (a stored skill with the derived id already exists) return 409\n * so the UI can offer an \"Open existing\" link instead of silently\n * overwriting.\n */\nexport const BUILDER_REGISTRY_INSTALL_ROUTE = createRoute({\n  method: 'POST',\n  path: '/editor/builder/registries/:registryId/install',\n  responseType: 'json',\n  pathParamSchema: builderRegistryPathParams,\n  bodySchema: builderRegistryInstallBodySchema,\n  responseSchema: builderRegistryInstallResponseSchema,\n  summary: 'Install a registry skill into stored skills',\n  description: 'Fetches a skill from the configured registry and persists it as a new stored skill.',\n  tags: ['Editor', 'Skills'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:write',\n  handler: async ({ mastra, requestContext, registryId, owner, repo, skillName, visibility: bodyVisibility }) => {\n    try {\n      await requireEnabledRegistry(mastra, registryId);\n\n      const storage = mastra.getStorage();\n      if (!storage) {\n        throw new HTTPException(500, { message: 'Storage is not configured' });\n      }\n      const skillStore = await storage.getStore('skills');\n      if (!skillStore) {\n        throw new HTTPException(500, { message: 'Skills storage domain is not available' });\n      }\n\n      // Pull files from the registry\n      const result = await fetchSkillFiles(owner, repo, skillName);\n      if (!result || result.files.length === 0) {\n        throw new HTTPException(404, {\n          message: `Could not find skill \"${skillName}\" in ${owner}/${repo}.`,\n        });\n      }\n\n      const safeSkillId = assertSafeSkillName(result.skillId);\n      const files = buildFileTree(result.files);\n\n      // Parse SKILL.md frontmatter into structured fields. Splitting\n      // frontmatter (name/description) from the markdown body keeps the\n      // body as the agent-facing `instructions` instead of polluting it\n      // with raw YAML metadata. SKILL.md missing or unparseable simply\n      // yields a null snapshot — registry-provided values then fill in.\n      const snapshot = parseSkillSnapshot(result.files);\n\n      const resolvedName = snapshot?.name ?? safeSkillId;\n      const description = snapshot?.description ?? `Imported from ${owner}/${repo}`;\n      const id = toSlug(resolvedName) || safeSkillId;\n\n      if (!id) {\n        throw new HTTPException(400, {\n          message: 'Could not derive skill ID from registry skill metadata.',\n        });\n      }\n\n      // Reject collisions instead of silently overwriting; UI offers \"Open existing\".\n      const existing = await skillStore.getById(id);\n      if (existing) {\n        throw new HTTPException(409, {\n          message: `Skill with id \"${id}\" already exists.`,\n          // Surface the existing id so the client can deep-link.\n          cause: { storedSkillId: id },\n        });\n      }\n\n      // Match the standard create flow: no caller = always public, otherwise default private.\n      const authorId = getCallerAuthorId(requestContext) ?? undefined;\n      const visibility: 'private' | 'public' = authorId ? (bodyVisibility ?? 'private') : 'public';\n\n      // Use the SKILL.md body (post-frontmatter) as instructions. Frontmatter\n      // values are already lifted into structured columns above, so re-storing\n      // them in `instructions` would both duplicate metadata and feed YAML\n      // into the agent's prompt. Fall back to description when no usable body\n      // exists so `resolved.snapshot.instructions` stays non-empty.\n      const instructions = snapshot?.instructions?.trim() ? snapshot.instructions : description;\n\n      await skillStore.create({\n        skill: {\n          id,\n          authorId,\n          visibility,\n          name: resolvedName,\n          description,\n          instructions,\n          files,\n          metadata: {\n            origin: {\n              type: 'skills-sh',\n              owner,\n              repo,\n              skillName,\n            },\n          },\n        },\n      });\n\n      return {\n        storedSkillId: id,\n        name: resolvedName,\n        filesWritten: result.files.length,\n      };\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      return handleError(error, 'Error installing registry skill');\n    }\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,6BAA6B,EAAE,OAAO;CACjD,IAAI,EAAE,QAAQ,WAAW,CAAC,CAAC,SAAS,4BAA4B;CAChE,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS,4DAA4D;CAC1F,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,8BAA8B;AAC3D,CAAC;;AAGD,MAAa,kCAAkC,EAAE,OAAO,EACtD,YAAY,EAAE,MAAM,0BAA0B,EAChD,CAAC;;AAOD,MAAa,4BAA4B,EAAE,OAAO,EAChD,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS,0CAAwC,EAC1E,CAAC;AAED,MAAa,mCAAmC,EAAE,OAAO;CACvD,GAAG,EAAE,OAAO,CAAC,CAAC,SAAS,cAAc;CACrC,OAAO,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,mCAAmC;AACpH,CAAC;AAED,MAAa,oCAAoC,EAC9C,OAAO;CACN,OAAO,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,mCAAmC;CAClH,QAAQ,EAAE,OACP,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC,CACV,SAAS,uDAAuD;AACrE,CAAC,CAAC,CACD,QAAO,SAAQ,KAAK,SAAS,KAAK,UAAU,GAAG;CAC9C,SAAS;CACT,MAAM,CAAC,QAAQ;AACjB,CAAC;AAEH,MAAa,oCAAoC,EAAE,OAAO;CACxD,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,yBAAyB;CACpD,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,wBAAwB;CAClD,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,wBAAwB;AACpD,CAAC;;;;;;;AAYD,MAAa,mCAAmC,EAAE,OAAO;CACvD,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,yBAAyB;CACpD,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,wBAAwB;CAClD,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS,8BAA8B;CAC7D,YAAY,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,qCAAqC;AACrG,CAAC;;AAGD,MAAa,uCAAuC,EAAE,OAAO;CAC3D,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS,sCAAsC;CACzE,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,qBAAqB;CAC/C,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS,8DAA8D;AAClG,CAAC;;;;AC3CD,MAAM,kBAA0C,EAC9C,aAAa,YACf;;;;;;;AAcA,eAAe,kBAAkB,QAA2C;CAC1E,MAAM,SAAS,OAAO,UAAU;CAChC,IAAI,CAAC,UAAU,OAAO,OAAO,mBAAmB,YAC9C,OAAO,CAAC;EAAE,IAAI;EAAa,SAAS;EAAO,OAAO,gBAAgB;CAAc,CAAC;CAInF,OAAO,CACL;EACE,IAAI;EACJ,WAJe,MADG,OAAO,eAAe,EAAA,EAChB,gBAAgB,EAAA,EAInB,UAAU,YAAY;EAC3C,OAAO,gBAAgB;CACzB,CACF;AACF;;;;;AAMA,eAAe,uBAAuB,QAAgB,YAAmC;CAEvF,MAAM,SAAQ,MADK,kBAAkB,MAAM,EAAA,CACxB,MAAK,MAAK,EAAE,OAAO,UAAU;CAChD,IAAI,CAAC,SAAS,CAAC,MAAM,SACnB,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,qBAAqB,CAAC;AAElE;;;;;;;;AAaA,SAAS,cACP,OACwB;CACxB,MAAM,OAA+B,CAAC;CAEtC,KAAK,MAAM,QAAQ,OAAO;EAExB,MAAM,WADW,mBAAmB,KAAK,IACjB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;EACnD,IAAI,SAAS,WAAW,GAAG;EAE3B,IAAI,SAAS;EACb,KAAK,IAAI,IAAI,GAAG,IAAI,SAAS,SAAS,GAAG,KAAK;GAC5C,MAAM,UAAU,SAAS;GACzB,IAAI,SAAS,OAAO,MAAK,SAAQ,KAAK,SAAS,YAAY,KAAK,SAAS,OAAO;GAChF,IAAI,CAAC,QAAQ;IACX,SAAS;KAAE,MAAM;KAAS,MAAM;KAAU,UAAU,CAAC;IAAE;IACvD,OAAO,KAAK,MAAM;GACpB;GACA,IAAI,CAAC,OAAO,UAAU,OAAO,WAAW,CAAC;GACzC,SAAS,OAAO;EAClB;EAEA,MAAM,WAAW,SAAS,SAAS,SAAS;EAC5C,MAAM,UAAU,KAAK,aAAa,WAAW,OAAO,KAAK,KAAK,SAAS,QAAQ,CAAC,CAAC,SAAS,OAAO,IAAI,KAAK;EAC1G,OAAO,KAAK;GAAE,MAAM;GAAU,MAAM;GAAQ;EAAQ,CAAC;CACvD;CAEA,OAAO;AACT;AAqBA,SAAS,mBACP,OAC4B;CAC5B,MAAM,UAAU,MAAM,MAAK,MAAK,EAAE,SAAS,UAAU;CACrD,IAAI,CAAC,SAAS,OAAO;CAErB,MAAM,MACJ,QAAQ,aAAa,WAAW,OAAO,KAAK,QAAQ,SAAS,QAAQ,CAAC,CAAC,SAAS,OAAO,IAAI,QAAQ;CAErG,MAAM,UAAU,IAAI,MAAM,6CAA6C;CACvE,IAAI,CAAC,SACH,OAAO,EAAE,cAAc,IAAI,KAAK,EAAE;CAGpC,MAAM,UAAU,QAAQ,MAAM;CAC9B,MAAM,OAAO,QAAQ,MAAM;CAC3B,MAAM,cAAsC,CAAC;CAC7C,KAAK,MAAM,QAAQ,QAAQ,MAAM,OAAO,GAAG;EACzC,MAAM,IAAI,KAAK,MAAM,+BAA+B;EACpD,IAAI,CAAC,GAAG;EACR,MAAM,MAAM,EAAE;EACd,MAAM,QAAQ,EAAE,MAAM;EACtB,IAAI,CAAC,KAAK;EAGV,YAAY,OAAO,MAAM,KAAK,CAAC,CAAC,QAAQ,kBAAkB,IAAI;CAChE;CAEA,OAAO;EACL,MAAM,YAAY;EAClB,aAAa,YAAY;EACzB,cAAc,KAAK,KAAK;CAC1B;AACF;;;;;;;;AAaA,MAAa,gCAAgC,YAAY;CACvD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,QAAQ;CACf,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,aAAa;EAC7B,IAAI;GAEF,OAAO,EAAE,YAAA,MADgB,kBAAkB,MAAM,EAC7B;EACtB,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,kCAAkC;EAC9D;CACF;AACF,CAAC;;;;;;;AAQD,MAAa,gCAAgC,YAAY;CACvD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,QAAQ;CACzB,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,YAAY,GAAG,YAAY;EACnD,IAAI;GACF,MAAM,uBAAuB,QAAQ,UAAU;GAC/C,OAAO,MAAM,eAAe;IAAE;IAAG;GAAM,CAAC;EAC1C,SAAS,OAAO;GACd,IAAI,iBAAiB,eAAe,MAAM;GAC1C,OAAO,YAAY,OAAO,0BAA0B;EACtD;CACF;AACF,CAAC;;;;;;AAOD,MAAa,iCAAiC,YAAY;CACxD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,QAAQ;CACzB,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,YAAY,OAAO,aAAa;EACxD,IAAI;GACF,MAAM,uBAAuB,QAAQ,UAAU;GAC/C,OAAO,MAAM,mBAAmB;IAAE;IAAO;GAAO,CAAC;EACnD,SAAS,OAAO;GACd,IAAI,iBAAiB,eAAe,MAAM;GAC1C,OAAO,YAAY,OAAO,+BAA+B;EAC3D;CACF;AACF,CAAC;;;;;;AAOD,MAAa,iCAAiC,YAAY;CACxD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,QAAQ;CACzB,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,YAAY,OAAO,MAAM,MAAM,gBAAgB;EACvE,IAAI;GACF,MAAM,uBAAuB,QAAQ,UAAU;GAC/C,OAAO,MAAM,gBAAgB;IAAE;IAAO;IAAM;GAAU,CAAC;EACzD,SAAS,OAAO;GACd,IAAI,iBAAiB,eAAe,MAAM;GAC1C,OAAO,YAAY,OAAO,8BAA8B;EAC1D;CACF;AACF,CAAC;;;;;;;;;;;;;;AAeD,MAAa,iCAAiC,YAAY;CACxD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,YAAY;CACZ,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,QAAQ;CACzB,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,gBAAgB,YAAY,OAAO,MAAM,WAAW,YAAY,qBAAqB;EAC7G,IAAI;GACF,MAAM,uBAAuB,QAAQ,UAAU;GAE/C,MAAM,UAAU,OAAO,WAAW;GAClC,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,4BAA4B,CAAC;GAEvE,MAAM,aAAa,MAAM,QAAQ,SAAS,QAAQ;GAClD,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,yCAAyC,CAAC;GAIpF,MAAM,SAAS,MAAM,gBAAgB,OAAO,MAAM,SAAS;GAC3D,IAAI,CAAC,UAAU,OAAO,MAAM,WAAW,GACrC,MAAM,IAAI,cAAc,KAAK,EAC3B,SAAS,yBAAyB,UAAU,OAAO,MAAM,GAAG,KAAK,GACnE,CAAC;GAGH,MAAM,cAAc,oBAAoB,OAAO,OAAO;GACtD,MAAM,QAAQ,cAAc,OAAO,KAAK;GAOxC,MAAM,WAAW,mBAAmB,OAAO,KAAK;GAEhD,MAAM,eAAe,UAAU,QAAQ;GACvC,MAAM,cAAc,UAAU,eAAe,iBAAiB,MAAM,GAAG;GACvE,MAAM,KAAK,OAAO,YAAY,KAAK;GAEnC,IAAI,CAAC,IACH,MAAM,IAAI,cAAc,KAAK,EAC3B,SAAS,0DACX,CAAC;GAKH,IAAI,MADmB,WAAW,QAAQ,EAAE,GAE1C,MAAM,IAAI,cAAc,KAAK;IAC3B,SAAS,kBAAkB,GAAG;IAE9B,OAAO,EAAE,eAAe,GAAG;GAC7B,CAAC;GAIH,MAAM,WAAW,kBAAkB,cAAc,KAAK,KAAA;GACtD,MAAM,aAAmC,WAAY,kBAAkB,YAAa;GAOpF,MAAM,eAAe,UAAU,cAAc,KAAK,IAAI,SAAS,eAAe;GAE9E,MAAM,WAAW,OAAO,EACtB,OAAO;IACL;IACA;IACA;IACA,MAAM;IACN;IACA;IACA;IACA,UAAU,EACR,QAAQ;KACN,MAAM;KACN;KACA;KACA;IACF,EACF;GACF,EACF,CAAC;GAED,OAAO;IACL,eAAe;IACf,MAAM;IACN,cAAc,OAAO,MAAM;GAC7B;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,eAAe,MAAM;GAC1C,OAAO,YAAY,OAAO,iCAAiC;EAC7D;CACF;AACF,CAAC"}
+{"version":3,"file":"builder-registry-6A0b4EwP.js","names":[],"sources":["../src/server/schemas/builder-registry.ts","../src/server/handlers/builder-registry.ts"],"sourcesContent":["/**\n * Builder Registry Schemas\n *\n * Schemas for the Agent Builder skill registry routes. These are distinct from\n * the workspace skills.sh proxy schemas because:\n *   - Builder routes are not scoped to a workspace.\n *   - Builder install does not accept a `mount` field.\n *   - Builder install body carries visibility + the resolved registry id.\n *   - Builder install response returns the created stored skill id.\n *\n * The upstream skills.sh proxy response shapes are reused via the shared\n * `skillsShSearchResponseSchema`, `skillsShListResponseSchema`, and\n * `skillsShPreviewResponseSchema` since the wire shape from skills.sh is\n * registry-independent.\n */\n\nimport { z } from 'zod/v4';\n\n// =============================================================================\n// Registry list\n// =============================================================================\n\n/** Single entry in the registries list. */\nexport const builderRegistryEntrySchema = z.object({\n  id: z.literal('skills-sh').describe('Stable registry identifier'),\n  enabled: z.boolean().describe('Whether this registry is enabled in the running deployment'),\n  label: z.string().describe('Human-readable registry name'),\n});\n\n/** Response for `GET /editor/builder/registries`. */\nexport const builderRegistriesResponseSchema = z.object({\n  registries: z.array(builderRegistryEntrySchema),\n});\n\n// =============================================================================\n// Search / popular / preview\n// =============================================================================\n\n/** Path params used by every per-registry route. */\nexport const builderRegistryPathParams = z.object({\n  registryId: z.string().describe('Registry identifier (e.g. \"skills-sh\")'),\n});\n\nexport const builderRegistrySearchQuerySchema = z.object({\n  q: z.string().describe('Search query'),\n  limit: z.coerce.number().int().min(1).max(100).optional().default(10).describe('Maximum number of results (1-100)'),\n});\n\nexport const builderRegistryPopularQuerySchema = z\n  .object({\n    limit: z.coerce.number().int().min(1).max(100).optional().default(10).describe('Maximum number of results (1-100)'),\n    offset: z.coerce\n      .number()\n      .int()\n      .min(0)\n      .optional()\n      .default(0)\n      .describe('Offset for pagination (must be a multiple of `limit`)'),\n  })\n  .refine(args => args.offset % args.limit === 0, {\n    message: 'offset must be a multiple of limit (the upstream registry pages by `limit`)',\n    path: ['offset'],\n  });\n\nexport const builderRegistryPreviewQuerySchema = z.object({\n  owner: z.string().describe('GitHub repository owner'),\n  repo: z.string().describe('GitHub repository name'),\n  path: z.string().describe('Skill name within repo'),\n});\n\n// =============================================================================\n// Install\n// =============================================================================\n\n/**\n * Body for `POST /editor/builder/registries/:registryId/install`.\n *\n * Visibility behaves like the standard stored-skill create flow: optional,\n * defaults to private when the caller is authenticated.\n */\nexport const builderRegistryInstallBodySchema = z.object({\n  owner: z.string().describe('GitHub repository owner'),\n  repo: z.string().describe('GitHub repository name'),\n  skillName: z.string().describe('Skill name from the registry'),\n  visibility: z.enum(['private', 'public']).optional().describe('Visibility for the new stored skill'),\n});\n\n/** Response for the install route. Mirrors stored-skill identity fields. */\nexport const builderRegistryInstallResponseSchema = z.object({\n  storedSkillId: z.string().describe('Id of the newly created stored skill'),\n  name: z.string().describe('Resolved skill name'),\n  filesWritten: z.number().describe('Number of files materialized into the skill version snapshot'),\n});\n\nexport type BuilderRegistryEntry = z.infer<typeof builderRegistryEntrySchema>;\nexport type BuilderRegistriesResponse = z.infer<typeof builderRegistriesResponseSchema>;\nexport type BuilderRegistryInstallBody = z.infer<typeof builderRegistryInstallBodySchema>;\nexport type BuilderRegistryInstallResponse = z.infer<typeof builderRegistryInstallResponseSchema>;\n","/**\n * Builder Registry Handlers\n *\n * Routes that let admins browse and install skills from configured external\n * registries (currently just skills.sh) directly into the Builder's stored\n * skills DB. Distinct from the workspace skills.sh routes, which write to a\n * workspace filesystem and never touch storage.\n *\n * Registry availability is driven by `AgentBuilderOptions.registries`. When\n * the requested registry is disabled (or the builder is missing entirely),\n * the routes 404 instead of leaking the surface.\n */\n\nimport type { Mastra } from '@mastra/core';\nimport type { StorageSkillFileNode } from '@mastra/core/storage';\n\nimport { HTTPException } from '../http-exception';\nimport {\n  builderRegistriesResponseSchema,\n  builderRegistryInstallBodySchema,\n  builderRegistryInstallResponseSchema,\n  builderRegistryPathParams,\n  builderRegistryPopularQuerySchema,\n  builderRegistryPreviewQuerySchema,\n  builderRegistrySearchQuerySchema,\n} from '../schemas/builder-registry';\nimport {\n  skillsShListResponseSchema,\n  skillsShPreviewResponseSchema,\n  skillsShSearchResponseSchema,\n} from '../schemas/workspace';\nimport { createRoute } from '../server-adapter/routes/route-builder';\nimport { toSlug } from '../utils';\nimport { getCallerAuthorId } from './authorship';\nimport { handleError } from './error';\nimport {\n  assertSafeFilePath,\n  assertSafeSkillName,\n  fetchSkillFiles,\n  getPopularSkillsSh,\n  previewSkillsSh,\n  searchSkillsSh,\n} from './skills-sh-shared';\n\n// =============================================================================\n// Registry resolution\n// =============================================================================\n\n/** Stable identifiers + display labels for every supported registry. */\nconst REGISTRY_LABELS: Record<string, string> = {\n  'skills-sh': 'skills.sh',\n};\n\ninterface RegistryStatus {\n  id: 'skills-sh';\n  enabled: boolean;\n  label: string;\n}\n\n/**\n * Resolve which registries are enabled for the running deployment by reading\n * the builder's `registries` config. Returns a list with all known registries\n * (so the frontend can render an empty/disabled state) plus their enabled\n * flag.\n */\nasync function resolveRegistries(mastra: Mastra): Promise<RegistryStatus[]> {\n  const editor = mastra.getEditor();\n  if (!editor || typeof editor.resolveBuilder !== 'function') {\n    return [{ id: 'skills-sh', enabled: false, label: REGISTRY_LABELS['skills-sh']! }];\n  }\n  const builder = await editor.resolveBuilder();\n  const registries = builder?.getRegistries?.();\n  return [\n    {\n      id: 'skills-sh',\n      enabled: registries?.skillsSh?.enabled === true,\n      label: REGISTRY_LABELS['skills-sh']!,\n    },\n  ];\n}\n\n/**\n * Hard-gate: throws 404 when the requested registry is unknown or disabled.\n * Mirrors `requireBuilderFeature` semantics — no surface leak for OFF registries.\n */\nasync function requireEnabledRegistry(mastra: Mastra, registryId: string): Promise<void> {\n  const list = await resolveRegistries(mastra);\n  const match = list.find(r => r.id === registryId);\n  if (!match || !match.enabled) {\n    throw new HTTPException(404, { message: 'Registry not found' });\n  }\n}\n\n// =============================================================================\n// File-tree helpers\n// =============================================================================\n\n/**\n * Convert a flat list of `{ path, content, encoding }` entries into the\n * `StorageSkillFileNode` tree shape expected by the stored-skills create path.\n *\n * Each path is validated via `assertSafeFilePath` to prevent traversal from\n * upstream-controlled responses. Folder nodes are created on demand.\n */\nfunction buildFileTree(\n  files: Array<{ path: string; content: string; encoding: 'utf-8' | 'base64' }>,\n): StorageSkillFileNode[] {\n  const root: StorageSkillFileNode[] = [];\n\n  for (const file of files) {\n    const safePath = assertSafeFilePath(file.path);\n    const segments = safePath.split('/').filter(Boolean);\n    if (segments.length === 0) continue;\n\n    let cursor = root;\n    for (let i = 0; i < segments.length - 1; i++) {\n      const segment = segments[i]!;\n      let folder = cursor.find(node => node.type === 'folder' && node.name === segment);\n      if (!folder) {\n        folder = { name: segment, type: 'folder', children: [] };\n        cursor.push(folder);\n      }\n      if (!folder.children) folder.children = [];\n      cursor = folder.children;\n    }\n\n    const fileName = segments[segments.length - 1]!;\n    const content = file.encoding === 'base64' ? Buffer.from(file.content, 'base64').toString('utf-8') : file.content;\n    cursor.push({ name: fileName, type: 'file', content });\n  }\n\n  return root;\n}\n\n/**\n * Locally-bound SKILL.md frontmatter parser.\n *\n * Mirrors `parseSkillSnapshotFromFiles` from `@mastra/core/workspace`, but\n * inlined here because the server package's `@mastra/core` peer floor\n * (>=1.32.0) predates that helper. Once the floor is bumped to a release\n * containing the helper, this can be replaced by the shared core import.\n *\n * Only SKILL.md is consulted — frontmatter is split from the body using a\n * minimal YAML key:value reader sufficient for the fields registries\n * actually use (name, description). The body is everything after the\n * second `---` line, trimmed.\n */\ntype ParsedSkillSnapshot = {\n  name?: string;\n  description?: string;\n  instructions: string;\n};\n\nfunction parseSkillSnapshot(\n  files: Array<{ path: string; content: string; encoding: 'utf-8' | 'base64' }>,\n): ParsedSkillSnapshot | null {\n  const skillMd = files.find(f => f.path === 'SKILL.md');\n  if (!skillMd) return null;\n\n  const raw =\n    skillMd.encoding === 'base64' ? Buffer.from(skillMd.content, 'base64').toString('utf-8') : skillMd.content;\n\n  const fmMatch = raw.match(/^---\\r?\\n([\\s\\S]*?)\\r?\\n---\\r?\\n?([\\s\\S]*)$/);\n  if (!fmMatch) {\n    return { instructions: raw.trim() };\n  }\n\n  const fmBlock = fmMatch[1] ?? '';\n  const body = fmMatch[2] ?? '';\n  const frontmatter: Record<string, string> = {};\n  for (const line of fmBlock.split(/\\r?\\n/)) {\n    const m = line.match(/^([A-Za-z0-9_-]+)\\s*:\\s*(.*)$/);\n    if (!m) continue;\n    const key = m[1];\n    const value = m[2] ?? '';\n    if (!key) continue;\n    // Strip surrounding quotes, leave the rest as-is. Registry SKILL.md\n    // frontmatter is consistently flat string fields in practice.\n    frontmatter[key] = value.trim().replace(/^[\"'](.*)[\"']$/, '$1');\n  }\n\n  return {\n    name: frontmatter.name,\n    description: frontmatter.description,\n    instructions: body.trim(),\n  };\n}\n\n// =============================================================================\n// Routes\n// =============================================================================\n\n/**\n * GET /editor/builder/registries\n *\n * Lists every known registry and whether it's enabled in this deployment.\n * Used by the Builder UI to decide whether to show the \"Browse registry\"\n * entry point at all.\n */\nexport const LIST_BUILDER_REGISTRIES_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/builder/registries',\n  responseType: 'json',\n  responseSchema: builderRegistriesResponseSchema,\n  summary: 'List available skill registries',\n  description: 'Returns the configured external skill registries and their enabled state.',\n  tags: ['Editor'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:read',\n  handler: async ({ mastra }) => {\n    try {\n      const registries = await resolveRegistries(mastra);\n      return { registries };\n    } catch (error) {\n      return handleError(error, 'Error listing builder registries');\n    }\n  },\n});\n\n/**\n * GET /editor/builder/registries/:registryId/search\n *\n * Proxies a search query to the underlying registry. Currently only\n * registryId=\"skills-sh\" is supported.\n */\nexport const BUILDER_REGISTRY_SEARCH_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/builder/registries/:registryId/search',\n  responseType: 'json',\n  pathParamSchema: builderRegistryPathParams,\n  queryParamSchema: builderRegistrySearchQuerySchema,\n  responseSchema: skillsShSearchResponseSchema,\n  summary: 'Search skills in a registry',\n  description: 'Proxies a search request to the configured registry to avoid CORS issues.',\n  tags: ['Editor', 'Skills'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:read',\n  handler: async ({ mastra, registryId, q, limit }) => {\n    try {\n      await requireEnabledRegistry(mastra, registryId);\n      return await searchSkillsSh({ q, limit });\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      return handleError(error, 'Error searching registry');\n    }\n  },\n});\n\n/**\n * GET /editor/builder/registries/:registryId/popular\n *\n * Returns the most popular skills in a registry.\n */\nexport const BUILDER_REGISTRY_POPULAR_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/builder/registries/:registryId/popular',\n  responseType: 'json',\n  pathParamSchema: builderRegistryPathParams,\n  queryParamSchema: builderRegistryPopularQuerySchema,\n  responseSchema: skillsShListResponseSchema,\n  summary: 'Get popular skills from a registry',\n  description: 'Proxies a popular-skills request to the configured registry to avoid CORS issues.',\n  tags: ['Editor', 'Skills'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:read',\n  handler: async ({ mastra, registryId, limit, offset }) => {\n    try {\n      await requireEnabledRegistry(mastra, registryId);\n      return await getPopularSkillsSh({ limit, offset });\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      return handleError(error, 'Error fetching popular skills');\n    }\n  },\n});\n\n/**\n * GET /editor/builder/registries/:registryId/preview\n *\n * Returns the rendered SKILL.md content for a single skill in the registry.\n */\nexport const BUILDER_REGISTRY_PREVIEW_ROUTE = createRoute({\n  method: 'GET',\n  path: '/editor/builder/registries/:registryId/preview',\n  responseType: 'json',\n  pathParamSchema: builderRegistryPathParams,\n  queryParamSchema: builderRegistryPreviewQuerySchema,\n  responseSchema: skillsShPreviewResponseSchema,\n  summary: 'Preview a skill from a registry',\n  description: 'Fetches the SKILL.md content for a single skill in the configured registry.',\n  tags: ['Editor', 'Skills'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:read',\n  handler: async ({ mastra, registryId, owner, repo, path: skillName }) => {\n    try {\n      await requireEnabledRegistry(mastra, registryId);\n      return await previewSkillsSh({ owner, repo, skillName });\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      return handleError(error, 'Error fetching skill preview');\n    }\n  },\n});\n\n/**\n * POST /editor/builder/registries/:registryId/install\n *\n * Fetches the full file tree for a skill from the registry, parses the\n * SKILL.md frontmatter for name/description, and persists everything as a\n * new stored skill. The registry origin is recorded under `metadata.origin`\n * so the UI can surface \"imported from skills.sh\" badges and re-resolve the\n * source later.\n *\n * Collisions (a stored skill with the derived id already exists) return 409\n * so the UI can offer an \"Open existing\" link instead of silently\n * overwriting.\n */\nexport const BUILDER_REGISTRY_INSTALL_ROUTE = createRoute({\n  method: 'POST',\n  path: '/editor/builder/registries/:registryId/install',\n  responseType: 'json',\n  pathParamSchema: builderRegistryPathParams,\n  bodySchema: builderRegistryInstallBodySchema,\n  responseSchema: builderRegistryInstallResponseSchema,\n  summary: 'Install a registry skill into stored skills',\n  description: 'Fetches a skill from the configured registry and persists it as a new stored skill.',\n  tags: ['Editor', 'Skills'],\n  requiresAuth: true,\n  requiresPermission: 'stored-skills:write',\n  handler: async ({ mastra, requestContext, registryId, owner, repo, skillName, visibility: bodyVisibility }) => {\n    try {\n      await requireEnabledRegistry(mastra, registryId);\n\n      const storage = mastra.getStorage();\n      if (!storage) {\n        throw new HTTPException(500, { message: 'Storage is not configured' });\n      }\n      const skillStore = await storage.getStore('skills');\n      if (!skillStore) {\n        throw new HTTPException(500, { message: 'Skills storage domain is not available' });\n      }\n\n      // Pull files from the registry\n      const result = await fetchSkillFiles(owner, repo, skillName);\n      if (!result || result.files.length === 0) {\n        throw new HTTPException(404, {\n          message: `Could not find skill \"${skillName}\" in ${owner}/${repo}.`,\n        });\n      }\n\n      const safeSkillId = assertSafeSkillName(result.skillId);\n      const files = buildFileTree(result.files);\n\n      // Parse SKILL.md frontmatter into structured fields. Splitting\n      // frontmatter (name/description) from the markdown body keeps the\n      // body as the agent-facing `instructions` instead of polluting it\n      // with raw YAML metadata. SKILL.md missing or unparseable simply\n      // yields a null snapshot — registry-provided values then fill in.\n      const snapshot = parseSkillSnapshot(result.files);\n\n      const resolvedName = snapshot?.name ?? safeSkillId;\n      const description = snapshot?.description ?? `Imported from ${owner}/${repo}`;\n      const id = toSlug(resolvedName) || safeSkillId;\n\n      if (!id) {\n        throw new HTTPException(400, {\n          message: 'Could not derive skill ID from registry skill metadata.',\n        });\n      }\n\n      // Reject collisions instead of silently overwriting; UI offers \"Open existing\".\n      const existing = await skillStore.getById(id);\n      if (existing) {\n        throw new HTTPException(409, {\n          message: `Skill with id \"${id}\" already exists.`,\n          // Surface the existing id so the client can deep-link.\n          cause: { storedSkillId: id },\n        });\n      }\n\n      // Match the standard create flow: no caller = always public, otherwise default private.\n      const authorId = getCallerAuthorId(requestContext) ?? undefined;\n      const visibility: 'private' | 'public' = authorId ? (bodyVisibility ?? 'private') : 'public';\n\n      // Use the SKILL.md body (post-frontmatter) as instructions. Frontmatter\n      // values are already lifted into structured columns above, so re-storing\n      // them in `instructions` would both duplicate metadata and feed YAML\n      // into the agent's prompt. Fall back to description when no usable body\n      // exists so `resolved.snapshot.instructions` stays non-empty.\n      const instructions = snapshot?.instructions?.trim() ? snapshot.instructions : description;\n\n      await skillStore.create({\n        skill: {\n          id,\n          authorId,\n          visibility,\n          name: resolvedName,\n          description,\n          instructions,\n          files,\n          metadata: {\n            origin: {\n              type: 'skills-sh',\n              owner,\n              repo,\n              skillName,\n            },\n          },\n        },\n      });\n\n      return {\n        storedSkillId: id,\n        name: resolvedName,\n        filesWritten: result.files.length,\n      };\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      return handleError(error, 'Error installing registry skill');\n    }\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,6BAA6B,EAAE,OAAO;CACjD,IAAI,EAAE,QAAQ,WAAW,CAAC,CAAC,SAAS,4BAA4B;CAChE,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS,4DAA4D;CAC1F,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,8BAA8B;AAC3D,CAAC;;AAGD,MAAa,kCAAkC,EAAE,OAAO,EACtD,YAAY,EAAE,MAAM,0BAA0B,EAChD,CAAC;;AAOD,MAAa,4BAA4B,EAAE,OAAO,EAChD,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS,0CAAwC,EAC1E,CAAC;AAED,MAAa,mCAAmC,EAAE,OAAO;CACvD,GAAG,EAAE,OAAO,CAAC,CAAC,SAAS,cAAc;CACrC,OAAO,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,mCAAmC;AACpH,CAAC;AAED,MAAa,oCAAoC,EAC9C,OAAO;CACN,OAAO,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,mCAAmC;CAClH,QAAQ,EAAE,OACP,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC,CACV,SAAS,uDAAuD;AACrE,CAAC,CAAC,CACD,QAAO,SAAQ,KAAK,SAAS,KAAK,UAAU,GAAG;CAC9C,SAAS;CACT,MAAM,CAAC,QAAQ;AACjB,CAAC;AAEH,MAAa,oCAAoC,EAAE,OAAO;CACxD,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,yBAAyB;CACpD,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,wBAAwB;CAClD,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,wBAAwB;AACpD,CAAC;;;;;;;AAYD,MAAa,mCAAmC,EAAE,OAAO;CACvD,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,yBAAyB;CACpD,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,wBAAwB;CAClD,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS,8BAA8B;CAC7D,YAAY,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,qCAAqC;AACrG,CAAC;;AAGD,MAAa,uCAAuC,EAAE,OAAO;CAC3D,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS,sCAAsC;CACzE,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,qBAAqB;CAC/C,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS,8DAA8D;AAClG,CAAC;;;;AC3CD,MAAM,kBAA0C,EAC9C,aAAa,YACf;;;;;;;AAcA,eAAe,kBAAkB,QAA2C;CAC1E,MAAM,SAAS,OAAO,UAAU;CAChC,IAAI,CAAC,UAAU,OAAO,OAAO,mBAAmB,YAC9C,OAAO,CAAC;EAAE,IAAI;EAAa,SAAS;EAAO,OAAO,gBAAgB;CAAc,CAAC;CAInF,OAAO,CACL;EACE,IAAI;EACJ,WAJe,MADG,OAAO,eAAe,EAAA,EAChB,gBAAgB,EAAA,EAInB,UAAU,YAAY;EAC3C,OAAO,gBAAgB;CACzB,CACF;AACF;;;;;AAMA,eAAe,uBAAuB,QAAgB,YAAmC;CAEvF,MAAM,SAAQ,MADK,kBAAkB,MAAM,EAAA,CACxB,MAAK,MAAK,EAAE,OAAO,UAAU;CAChD,IAAI,CAAC,SAAS,CAAC,MAAM,SACnB,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,qBAAqB,CAAC;AAElE;;;;;;;;AAaA,SAAS,cACP,OACwB;CACxB,MAAM,OAA+B,CAAC;CAEtC,KAAK,MAAM,QAAQ,OAAO;EAExB,MAAM,WADW,mBAAmB,KAAK,IACjB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;EACnD,IAAI,SAAS,WAAW,GAAG;EAE3B,IAAI,SAAS;EACb,KAAK,IAAI,IAAI,GAAG,IAAI,SAAS,SAAS,GAAG,KAAK;GAC5C,MAAM,UAAU,SAAS;GACzB,IAAI,SAAS,OAAO,MAAK,SAAQ,KAAK,SAAS,YAAY,KAAK,SAAS,OAAO;GAChF,IAAI,CAAC,QAAQ;IACX,SAAS;KAAE,MAAM;KAAS,MAAM;KAAU,UAAU,CAAC;IAAE;IACvD,OAAO,KAAK,MAAM;GACpB;GACA,IAAI,CAAC,OAAO,UAAU,OAAO,WAAW,CAAC;GACzC,SAAS,OAAO;EAClB;EAEA,MAAM,WAAW,SAAS,SAAS,SAAS;EAC5C,MAAM,UAAU,KAAK,aAAa,WAAW,OAAO,KAAK,KAAK,SAAS,QAAQ,CAAC,CAAC,SAAS,OAAO,IAAI,KAAK;EAC1G,OAAO,KAAK;GAAE,MAAM;GAAU,MAAM;GAAQ;EAAQ,CAAC;CACvD;CAEA,OAAO;AACT;AAqBA,SAAS,mBACP,OAC4B;CAC5B,MAAM,UAAU,MAAM,MAAK,MAAK,EAAE,SAAS,UAAU;CACrD,IAAI,CAAC,SAAS,OAAO;CAErB,MAAM,MACJ,QAAQ,aAAa,WAAW,OAAO,KAAK,QAAQ,SAAS,QAAQ,CAAC,CAAC,SAAS,OAAO,IAAI,QAAQ;CAErG,MAAM,UAAU,IAAI,MAAM,6CAA6C;CACvE,IAAI,CAAC,SACH,OAAO,EAAE,cAAc,IAAI,KAAK,EAAE;CAGpC,MAAM,UAAU,QAAQ,MAAM;CAC9B,MAAM,OAAO,QAAQ,MAAM;CAC3B,MAAM,cAAsC,CAAC;CAC7C,KAAK,MAAM,QAAQ,QAAQ,MAAM,OAAO,GAAG;EACzC,MAAM,IAAI,KAAK,MAAM,+BAA+B;EACpD,IAAI,CAAC,GAAG;EACR,MAAM,MAAM,EAAE;EACd,MAAM,QAAQ,EAAE,MAAM;EACtB,IAAI,CAAC,KAAK;EAGV,YAAY,OAAO,MAAM,KAAK,CAAC,CAAC,QAAQ,kBAAkB,IAAI;CAChE;CAEA,OAAO;EACL,MAAM,YAAY;EAClB,aAAa,YAAY;EACzB,cAAc,KAAK,KAAK;CAC1B;AACF;;;;;;;;AAaA,MAAa,gCAAgC,YAAY;CACvD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,QAAQ;CACf,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,aAAa;EAC7B,IAAI;GAEF,OAAO,EAAE,YAAA,MADgB,kBAAkB,MAAM,EAC7B;EACtB,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,kCAAkC;EAC9D;CACF;AACF,CAAC;;;;;;;AAQD,MAAa,gCAAgC,YAAY;CACvD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,QAAQ;CACzB,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,YAAY,GAAG,YAAY;EACnD,IAAI;GACF,MAAM,uBAAuB,QAAQ,UAAU;GAC/C,OAAO,MAAM,eAAe;IAAE;IAAG;GAAM,CAAC;EAC1C,SAAS,OAAO;GACd,IAAI,iBAAiB,eAAe,MAAM;GAC1C,OAAO,YAAY,OAAO,0BAA0B;EACtD;CACF;AACF,CAAC;;;;;;AAOD,MAAa,iCAAiC,YAAY;CACxD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,QAAQ;CACzB,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,YAAY,OAAO,aAAa;EACxD,IAAI;GACF,MAAM,uBAAuB,QAAQ,UAAU;GAC/C,OAAO,MAAM,mBAAmB;IAAE;IAAO;GAAO,CAAC;EACnD,SAAS,OAAO;GACd,IAAI,iBAAiB,eAAe,MAAM;GAC1C,OAAO,YAAY,OAAO,+BAA+B;EAC3D;CACF;AACF,CAAC;;;;;;AAOD,MAAa,iCAAiC,YAAY;CACxD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,QAAQ;CACzB,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,YAAY,OAAO,MAAM,MAAM,gBAAgB;EACvE,IAAI;GACF,MAAM,uBAAuB,QAAQ,UAAU;GAC/C,OAAO,MAAM,gBAAgB;IAAE;IAAO;IAAM;GAAU,CAAC;EACzD,SAAS,OAAO;GACd,IAAI,iBAAiB,eAAe,MAAM;GAC1C,OAAO,YAAY,OAAO,8BAA8B;EAC1D;CACF;AACF,CAAC;;;;;;;;;;;;;;AAeD,MAAa,iCAAiC,YAAY;CACxD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,YAAY;CACZ,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,QAAQ;CACzB,cAAc;CACd,oBAAoB;CACpB,SAAS,OAAO,EAAE,QAAQ,gBAAgB,YAAY,OAAO,MAAM,WAAW,YAAY,qBAAqB;EAC7G,IAAI;GACF,MAAM,uBAAuB,QAAQ,UAAU;GAE/C,MAAM,UAAU,OAAO,WAAW;GAClC,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,4BAA4B,CAAC;GAEvE,MAAM,aAAa,MAAM,QAAQ,SAAS,QAAQ;GAClD,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,yCAAyC,CAAC;GAIpF,MAAM,SAAS,MAAM,gBAAgB,OAAO,MAAM,SAAS;GAC3D,IAAI,CAAC,UAAU,OAAO,MAAM,WAAW,GACrC,MAAM,IAAI,cAAc,KAAK,EAC3B,SAAS,yBAAyB,UAAU,OAAO,MAAM,GAAG,KAAK,GACnE,CAAC;GAGH,MAAM,cAAc,oBAAoB,OAAO,OAAO;GACtD,MAAM,QAAQ,cAAc,OAAO,KAAK;GAOxC,MAAM,WAAW,mBAAmB,OAAO,KAAK;GAEhD,MAAM,eAAe,UAAU,QAAQ;GACvC,MAAM,cAAc,UAAU,eAAe,iBAAiB,MAAM,GAAG;GACvE,MAAM,KAAK,OAAO,YAAY,KAAK;GAEnC,IAAI,CAAC,IACH,MAAM,IAAI,cAAc,KAAK,EAC3B,SAAS,0DACX,CAAC;GAKH,IAAI,MADmB,WAAW,QAAQ,EAAE,GAE1C,MAAM,IAAI,cAAc,KAAK;IAC3B,SAAS,kBAAkB,GAAG;IAE9B,OAAO,EAAE,eAAe,GAAG;GAC7B,CAAC;GAIH,MAAM,WAAW,kBAAkB,cAAc,KAAK,KAAA;GACtD,MAAM,aAAmC,WAAY,kBAAkB,YAAa;GAOpF,MAAM,eAAe,UAAU,cAAc,KAAK,IAAI,SAAS,eAAe;GAE9E,MAAM,WAAW,OAAO,EACtB,OAAO;IACL;IACA;IACA;IACA,MAAM;IACN;IACA;IACA;IACA,UAAU,EACR,QAAQ;KACN,MAAM;KACN;KACA;KACA;IACF,EACF;GACF,EACF,CAAC;GAED,OAAO;IACL,eAAe;IACf,MAAM;IACN,cAAc,OAAO,MAAM;GAC7B;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,eAAe,MAAM;GAC1C,OAAO,YAAY,OAAO,iCAAiC;EAC7D;CACF;AACF,CAAC"}

package/dist/{builder-registry-bpbwRFZE.cjs → builder-registry-DbSG3HJ8.cjs}

@@ -1,6 +1,6 @@
 const require_http_exception = require("./http-exception-CKDHupKw.cjs");
 const require_route_builder = require("./route-builder-2yrD15TL.cjs");
-const require_utils = require("./utils-CfF-SHpC.cjs");
+const require_utils = require("./utils-CJxnYdr3.cjs");
 const require_server_handlers_error = require("./server/handlers/error.cjs");
 const require_workspace = require("./workspace-BJYV2lkt.cjs");
 const require_server_handlers_authorship = require("./server/handlers/authorship.cjs");
@@ -380,4 +380,4 @@ Object.defineProperty(exports, "LIST_BUILDER_REGISTRIES_ROUTE", {
 	}
 });
 
-//# sourceMappingURL=builder-registry-bpbwRFZE.cjs.map
+//# sourceMappingURL=builder-registry-DbSG3HJ8.cjs.map