@mastra/server 1.79.0-alpha.10 → 1.79.0-alpha.11

package/dist/server/handlers/authorship.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"authorship.cjs","names":["MASTRA_RESOURCE_ID_KEY","MASTRA_USER_KEY","MASTRA_USER_PERMISSIONS_KEY","HTTPException"],"sources":["../../../src/server/handlers/authorship.ts"],"sourcesContent":["import { matchesPermission } from '@mastra/core/auth/ee';\nimport type { RequestContext } from '@mastra/core/di';\n\nimport { MASTRA_RESOURCE_ID_KEY, MASTRA_USER_KEY, MASTRA_USER_PERMISSIONS_KEY } from '../constants';\nimport { HTTPException } from '../http-exception';\n\n/**\n * Shape of a stored record that carries ownership + visibility metadata.\n * Used by `matchesAuthorFilter` and the access-assertion helpers.\n */\nexport type OwnedRecord = {\n  authorId?: string | null;\n  visibility?: 'private' | 'public';\n};\n\n/**\n * Returns the author id associated with the authenticated caller, or `null`\n * if auth is not configured / the caller cannot be resolved.\n *\n * Prefers `MASTRA_RESOURCE_ID_KEY` (set by `authConfig.mapUserToResourceId`)\n * and falls back to `user.id` on the authenticated user object.\n */\nexport function getCallerAuthorId(requestContext: RequestContext): string | null {\n  const resourceId = requestContext.get(MASTRA_RESOURCE_ID_KEY);\n  if (typeof resourceId === 'string' && resourceId.length > 0) {\n    return resourceId;\n  }\n\n  const user = requestContext.get(MASTRA_USER_KEY);\n  if (user && typeof user === 'object' && 'id' in user) {\n    const id = user.id;\n    if (typeof id === 'string' && id.length > 0) {\n      return id;\n    }\n  }\n\n  return null;\n}\n\n/**\n * Returns the list of permission strings currently attached to the caller by\n * the RBAC provider. Returns an empty array when RBAC isn't configured.\n */\nexport function getCallerPermissions(requestContext: RequestContext): string[] {\n  const raw = requestContext.get(MASTRA_USER_PERMISSIONS_KEY);\n  if (Array.isArray(raw)) {\n    return raw.filter((p): p is string => typeof p === 'string');\n  }\n  return [];\n}\n\n/**\n * True if the caller holds a wildcard permission that lets them manage a\n * resource they don't own (e.g. admins listing agents across tenants).\n *\n * Recognizes `*`, `<resource>:*`, and `<resource>:admin`.\n */\nexport function hasAdminBypass(requestContext: RequestContext, resource: string): boolean {\n  const permissions = getCallerPermissions(requestContext);\n  if (permissions.length === 0) return false;\n  const wildcardAll = '*';\n  const resourceWildcard = `${resource}:*`;\n  const resourceAdmin = `${resource}:admin`;\n  return permissions.some(p => p === wildcardAll || p === resourceWildcard || p === resourceAdmin);\n}\n\n/**\n * True if the caller holds a permission explicitly scoped to a specific\n * resource id — e.g. `agents:read:agent-123` or `agents:*:agent-123`.\n *\n * Broad grants without a resource-id segment (e.g. the role-default\n * `agents:execute`) are intentionally NOT treated as satisfying ownership\n * overrides. Those broad grants already gate route access at the\n * `requiresPermission` layer; giving them a second life as per-record\n * overrides would defeat the owner/visibility model.\n *\n * When called without `resourceId` (the legacy shape), falls back to the\n * original \"any matching permission\" behavior.\n */\nexport function hasScopedPermission(args: {\n  requestContext: RequestContext;\n  resource: string;\n  action: string;\n  resourceId?: string;\n}): boolean {\n  const { requestContext, resource, action, resourceId } = args;\n  const permissions = getCallerPermissions(requestContext);\n  if (permissions.length === 0) return false;\n\n  if (!resourceId) {\n    const required = `${resource}:${action}`;\n    return permissions.some(p => matchesPermission(p, required));\n  }\n\n  const required = `${resource}:${action}:${resourceId}`;\n  return permissions.some(p => {\n    // Only honor grants that explicitly name a resource id. A granted\n    // permission with just `<resource>:<action>` (no id segment) is\n    // considered a broad role grant, not a per-record override.\n    const parts = p.split(':');\n    if (parts.length < 3) return false;\n    return matchesPermission(p, required);\n  });\n}\n\nexport type AuthorFilter =\n  | { kind: 'unrestricted' }\n  | { kind: 'exact'; authorId: string }\n  | { kind: 'ownedOrPublic'; callerAuthorId: string }\n  | { kind: 'publicOnly' }\n  | { kind: 'ownedOrPublicOthers'; callerAuthorId: string; queryAuthorId: string };\n\n/**\n * Resolves the filter to apply when listing owner-scoped records.\n *\n * Behavior matrix:\n * - Admin bypass + no query overrides           → `unrestricted`.\n * - Admin bypass + `authorId=X`                 → `exact` (all of X's rows).\n * - `visibility=public` (any caller)            → `publicOnly` (aggregate public rows across owners).\n * - `authorId=X`, caller === X                  → `exact` (all of caller's rows).\n * - `authorId=X`, caller !== X (non-admin)      → `ownedOrPublicOthers` (only X's public rows).\n * - No caller (auth off)                        → `unrestricted` (or `exact` if query supplied).\n * - Default                                     → `ownedOrPublic` (caller's rows + legacy unowned + any public rows).\n */\nexport function resolveAuthorFilter(args: {\n  requestContext: RequestContext;\n  resource: string;\n  queryAuthorId?: string;\n  queryVisibility?: 'public';\n}): AuthorFilter {\n  const { requestContext, resource, queryAuthorId, queryVisibility } = args;\n  const callerAuthorId = getCallerAuthorId(requestContext);\n  const bypass = hasAdminBypass(requestContext, resource);\n\n  if (queryVisibility === 'public' && !queryAuthorId) {\n    return { kind: 'publicOnly' };\n  }\n\n  if (bypass) {\n    return queryAuthorId ? { kind: 'exact', authorId: queryAuthorId } : { kind: 'unrestricted' };\n  }\n\n  // Auth isn't configured (no caller) → treat as unrestricted. The route's\n  // `requiresAuth`/`requiresPermission` is what gates access in that mode.\n  if (!callerAuthorId) {\n    return queryAuthorId ? { kind: 'exact', authorId: queryAuthorId } : { kind: 'unrestricted' };\n  }\n\n  if (queryAuthorId) {\n    if (queryAuthorId === callerAuthorId) {\n      return { kind: 'exact', authorId: callerAuthorId };\n    }\n    // Non-owner asking about another user: only that user's public rows are visible.\n    return { kind: 'ownedOrPublicOthers', callerAuthorId, queryAuthorId };\n  }\n\n  return { kind: 'ownedOrPublic', callerAuthorId };\n}\n\n/**\n * Returns `true` if the record is visible to the caller given the resolved\n * filter. See `resolveAuthorFilter` for the filter semantics.\n *\n * Legacy rows with `authorId == null` are treated as public (visible to all).\n */\nexport function matchesAuthorFilter(record: OwnedRecord, filter: AuthorFilter): boolean {\n  const owner = record.authorId ?? null;\n  const isPublic = record.visibility === 'public';\n\n  switch (filter.kind) {\n    case 'unrestricted':\n      return true;\n    case 'exact':\n      return owner === filter.authorId;\n    case 'ownedOrPublic':\n      return owner === null || owner === filter.callerAuthorId || isPublic;\n    case 'publicOnly':\n      return owner === null || isPublic;\n    case 'ownedOrPublicOthers':\n      // Filtering by another author's rows: only expose their public ones.\n      // Legacy unowned rows match if the query is for `null`; here the query\n      // is always for a concrete id, so unowned rows don't match.\n      return owner === filter.queryAuthorId && isPublic;\n  }\n}\n\n/**\n * Asserts the caller has read access to the record. Throws 404 if not.\n *\n * Read access is granted when:\n * - The record has no owner (legacy/public), OR\n * - The record is marked `visibility: 'public'`, OR\n * - The caller owns the record, OR\n * - The caller has admin bypass (`*`, `<resource>:*`, `<resource>:admin`), OR\n * - The caller holds `<resource>:read` or `<resource>:read:<resourceId>`.\n */\nexport function assertReadAccess(args: {\n  requestContext: RequestContext;\n  resource: string;\n  resourceId?: string;\n  record: OwnedRecord;\n}): void {\n  const { requestContext, resource, resourceId, record } = args;\n  const owner = record.authorId ?? null;\n\n  if (owner === null) return;\n  if (record.visibility === 'public') return;\n  if (hasAdminBypass(requestContext, resource)) return;\n\n  const callerAuthorId = getCallerAuthorId(requestContext);\n  // No authenticated user on the request context means auth is not configured\n  // (single-user/dev mode). When auth IS configured, coreAuthMiddleware\n  // rejects unauthenticated requests with 401 before they reach handlers,\n  // so an absent user here genuinely means no auth provider.\n  if (!callerAuthorId && !requestContext.get(MASTRA_USER_KEY)) return;\n  if (callerAuthorId === owner) return;\n\n  if (hasScopedPermission({ requestContext, resource, action: 'read', resourceId })) {\n    return;\n  }\n\n  throw new HTTPException(404, { message: 'Not found' });\n}\n\n/**\n * Asserts the caller has execute access to the record. Throws 404 if not.\n *\n * Execute access is granted when:\n * - The record has no owner (legacy/public), OR\n * - The record is marked `visibility: 'public'`, OR\n * - The caller owns the record, OR\n * - The caller has admin bypass (`*`, `<resource>:*`, `<resource>:admin`), OR\n * - The caller holds `<resource>:execute` / `<resource>:execute:<resourceId>`, OR\n * - The caller holds `<resource>:read` / `<resource>:read:<resourceId>`\n *   (read implies the ability to consume/chat with the resource).\n */\nexport function assertExecuteAccess(args: {\n  requestContext: RequestContext;\n  resource: string;\n  resourceId?: string;\n  record: OwnedRecord;\n}): void {\n  const { requestContext, resource, resourceId, record } = args;\n  const owner = record.authorId ?? null;\n\n  if (owner === null) return;\n  if (record.visibility === 'public') return;\n  if (hasAdminBypass(requestContext, resource)) return;\n\n  const callerAuthorId = getCallerAuthorId(requestContext);\n  if (!callerAuthorId && !requestContext.get(MASTRA_USER_KEY)) return; // No auth configured (see assertReadAccess)\n  if (callerAuthorId === owner) return;\n\n  if (hasScopedPermission({ requestContext, resource, action: 'execute', resourceId })) {\n    return;\n  }\n  if (hasScopedPermission({ requestContext, resource, action: 'read', resourceId })) {\n    return;\n  }\n\n  throw new HTTPException(404, { message: 'Not found' });\n}\n\n/**\n * Asserts the caller has write access (edit or delete) to the record.\n * Throws 404 if not.\n *\n * Write access is granted when:\n * - The record has no owner (legacy), OR\n * - The caller owns the record, OR\n * - The caller has admin bypass, OR\n * - The caller holds `<resource>:<action>` or `<resource>:<action>:<resourceId>`.\n *\n * `visibility: 'public'` alone does NOT grant write access.\n */\nexport function assertWriteAccess(args: {\n  requestContext: RequestContext;\n  resource: string;\n  resourceId?: string;\n  action: 'edit' | 'delete' | 'write';\n  record: OwnedRecord;\n}): void {\n  const { requestContext, resource, resourceId, action, record } = args;\n  const owner = record.authorId ?? null;\n\n  if (owner === null) return;\n  if (hasAdminBypass(requestContext, resource)) return;\n\n  const callerAuthorId = getCallerAuthorId(requestContext);\n  if (!callerAuthorId && !requestContext.get(MASTRA_USER_KEY)) return; // No auth configured (see assertReadAccess)\n  if (callerAuthorId === owner) return;\n\n  if (hasScopedPermission({ requestContext, resource, action, resourceId })) {\n    return;\n  }\n\n  throw new HTTPException(404, { message: 'Not found' });\n}\n\n/**\n * Asserts the caller has share access to the record. Throws 404 if not.\n *\n * Share access controls who can change a record's audience/visibility\n * (e.g. flipping `private` ↔ `public`). It is intentionally separate from\n * `write`: a caller with only `<resource>:write` MUST NOT be able to flip\n * visibility — that would let any editor expose private records.\n *\n * Share access is granted when:\n * - The record has no owner (legacy), OR\n * - The caller owns the record (creators can share their own records), OR\n * - The caller has admin bypass (`*`, `<resource>:*`, `<resource>:admin`), OR\n * - The caller holds `<resource>:share` / `<resource>:share:<resourceId>`\n *   (or any pattern that matches it, e.g. `*:share`).\n *\n * `visibility: 'public'` does NOT grant share access — being readable doesn't\n * imply the right to change who else can read.\n */\nexport function assertShareAccess(args: {\n  requestContext: RequestContext;\n  resource: string;\n  resourceId?: string;\n  record: OwnedRecord;\n}): void {\n  const { requestContext, resource, resourceId, record } = args;\n  const owner = record.authorId ?? null;\n\n  if (owner === null) return;\n  if (hasAdminBypass(requestContext, resource)) return;\n\n  const callerAuthorId = getCallerAuthorId(requestContext);\n  if (!callerAuthorId && !requestContext.get(MASTRA_USER_KEY)) return; // No auth configured (see assertReadAccess)\n  if (callerAuthorId === owner) return;\n\n  if (hasScopedPermission({ requestContext, resource, action: 'share', resourceId })) {\n    return;\n  }\n\n  throw new HTTPException(404, { message: 'Not found' });\n}\n\n/**\n * Alias for `assertWriteAccess` with `action: 'edit'`. Prefer `assertWriteAccess`\n * in new code so the action is explicit.\n */\nexport function assertOwnership(args: {\n  requestContext: RequestContext;\n  resource: string;\n  resourceId?: string;\n  record: OwnedRecord;\n}): void {\n  assertWriteAccess({ ...args, action: 'edit' });\n}\n"],"mappings":";;;;;;;;;;;;;AAsBA,SAAgB,kBAAkB,gBAA+C;CAC/E,MAAM,aAAa,eAAe,IAAIA,kBAAAA,sBAAsB;CAC5D,IAAI,OAAO,eAAe,YAAY,WAAW,SAAS,GACxD,OAAO;CAGT,MAAM,OAAO,eAAe,IAAIC,kBAAAA,eAAe;CAC/C,IAAI,QAAQ,OAAO,SAAS,YAAY,QAAQ,MAAM;EACpD,MAAM,KAAK,KAAK;EAChB,IAAI,OAAO,OAAO,YAAY,GAAG,SAAS,GACxC,OAAO;CAEX;CAEA,OAAO;AACT;;;;;AAMA,SAAgB,qBAAqB,gBAA0C;CAC7E,MAAM,MAAM,eAAe,IAAIC,kBAAAA,2BAA2B;CAC1D,IAAI,MAAM,QAAQ,GAAG,GACnB,OAAO,IAAI,QAAQ,MAAmB,OAAO,MAAM,QAAQ;CAE7D,OAAO,CAAC;AACV;;;;;;;AAQA,SAAgB,eAAe,gBAAgC,UAA2B;CACxF,MAAM,cAAc,qBAAqB,cAAc;CACvD,IAAI,YAAY,WAAW,GAAG,OAAO;CACrC,MAAM,cAAc;CACpB,MAAM,mBAAmB,GAAG,SAAS;CACrC,MAAM,gBAAgB,GAAG,SAAS;CAClC,OAAO,YAAY,MAAK,MAAK,MAAM,eAAe,MAAM,oBAAoB,MAAM,aAAa;AACjG;;;;;;;;;;;;;;AAeA,SAAgB,oBAAoB,MAKxB;CACV,MAAM,EAAE,gBAAgB,UAAU,QAAQ,eAAe;CACzD,MAAM,cAAc,qBAAqB,cAAc;CACvD,IAAI,YAAY,WAAW,GAAG,OAAO;CAErC,IAAI,CAAC,YAAY;EACf,MAAM,WAAW,GAAG,SAAS,GAAG;EAChC,OAAO,YAAY,MAAK,OAAA,GAAA,qBAAA,kBAAA,CAAuB,GAAG,QAAQ,CAAC;CAC7D;CAEA,MAAM,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG;CAC1C,OAAO,YAAY,MAAK,MAAK;EAK3B,IADc,EAAE,MAAM,GACd,CAAC,CAAC,SAAS,GAAG,OAAO;EAC7B,QAAA,GAAA,qBAAA,kBAAA,CAAyB,GAAG,QAAQ;CACtC,CAAC;AACH;;;;;;;;;;;;;AAqBA,SAAgB,oBAAoB,MAKnB;CACf,MAAM,EAAE,gBAAgB,UAAU,eAAe,oBAAoB;CACrE,MAAM,iBAAiB,kBAAkB,cAAc;CACvD,MAAM,SAAS,eAAe,gBAAgB,QAAQ;CAEtD,IAAI,oBAAoB,YAAY,CAAC,eACnC,OAAO,EAAE,MAAM,aAAa;CAG9B,IAAI,QACF,OAAO,gBAAgB;EAAE,MAAM;EAAS,UAAU;CAAc,IAAI,EAAE,MAAM,eAAe;CAK7F,IAAI,CAAC,gBACH,OAAO,gBAAgB;EAAE,MAAM;EAAS,UAAU;CAAc,IAAI,EAAE,MAAM,eAAe;CAG7F,IAAI,eAAe;EACjB,IAAI,kBAAkB,gBACpB,OAAO;GAAE,MAAM;GAAS,UAAU;EAAe;EAGnD,OAAO;GAAE,MAAM;GAAuB;GAAgB;EAAc;CACtE;CAEA,OAAO;EAAE,MAAM;EAAiB;CAAe;AACjD;;;;;;;AAQA,SAAgB,oBAAoB,QAAqB,QAA+B;CACtF,MAAM,QAAQ,OAAO,YAAY;CACjC,MAAM,WAAW,OAAO,eAAe;CAEvC,QAAQ,OAAO,MAAf;EACE,KAAK,gBACH,OAAO;EACT,KAAK,SACH,OAAO,UAAU,OAAO;EAC1B,KAAK,iBACH,OAAO,UAAU,QAAQ,UAAU,OAAO,kBAAkB;EAC9D,KAAK,cACH,OAAO,UAAU,QAAQ;EAC3B,KAAK,uBAIH,OAAO,UAAU,OAAO,iBAAiB;CAC7C;AACF;;;;;;;;;;;AAYA,SAAgB,iBAAiB,MAKxB;CACP,MAAM,EAAE,gBAAgB,UAAU,YAAY,WAAW;CACzD,MAAM,QAAQ,OAAO,YAAY;CAEjC,IAAI,UAAU,MAAM;CACpB,IAAI,OAAO,eAAe,UAAU;CACpC,IAAI,eAAe,gBAAgB,QAAQ,GAAG;CAE9C,MAAM,iBAAiB,kBAAkB,cAAc;CAKvD,IAAI,CAAC,kBAAkB,CAAC,eAAe,IAAA,cAAmB,GAAG;CAC7D,IAAI,mBAAmB,OAAO;CAE9B,IAAI,oBAAoB;EAAE;EAAgB;EAAU,QAAQ;EAAQ;CAAW,CAAC,GAC9E;CAGF,MAAM,IAAIC,uBAAAA,cAAc,KAAK,EAAE,SAAS,YAAY,CAAC;AACvD;;;;;;;;;;;;;AAcA,SAAgB,oBAAoB,MAK3B;CACP,MAAM,EAAE,gBAAgB,UAAU,YAAY,WAAW;CACzD,MAAM,QAAQ,OAAO,YAAY;CAEjC,IAAI,UAAU,MAAM;CACpB,IAAI,OAAO,eAAe,UAAU;CACpC,IAAI,eAAe,gBAAgB,QAAQ,GAAG;CAE9C,MAAM,iBAAiB,kBAAkB,cAAc;CACvD,IAAI,CAAC,kBAAkB,CAAC,eAAe,IAAA,cAAmB,GAAG;CAC7D,IAAI,mBAAmB,OAAO;CAE9B,IAAI,oBAAoB;EAAE;EAAgB;EAAU,QAAQ;EAAW;CAAW,CAAC,GACjF;CAEF,IAAI,oBAAoB;EAAE;EAAgB;EAAU,QAAQ;EAAQ;CAAW,CAAC,GAC9E;CAGF,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,YAAY,CAAC;AACvD;;;;;;;;;;;;;AAcA,SAAgB,kBAAkB,MAMzB;CACP,MAAM,EAAE,gBAAgB,UAAU,YAAY,QAAQ,WAAW;CACjE,MAAM,QAAQ,OAAO,YAAY;CAEjC,IAAI,UAAU,MAAM;CACpB,IAAI,eAAe,gBAAgB,QAAQ,GAAG;CAE9C,MAAM,iBAAiB,kBAAkB,cAAc;CACvD,IAAI,CAAC,kBAAkB,CAAC,eAAe,IAAA,cAAmB,GAAG;CAC7D,IAAI,mBAAmB,OAAO;CAE9B,IAAI,oBAAoB;EAAE;EAAgB;EAAU;EAAQ;CAAW,CAAC,GACtE;CAGF,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,YAAY,CAAC;AACvD;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,kBAAkB,MAKzB;CACP,MAAM,EAAE,gBAAgB,UAAU,YAAY,WAAW;CACzD,MAAM,QAAQ,OAAO,YAAY;CAEjC,IAAI,UAAU,MAAM;CACpB,IAAI,eAAe,gBAAgB,QAAQ,GAAG;CAE9C,MAAM,iBAAiB,kBAAkB,cAAc;CACvD,IAAI,CAAC,kBAAkB,CAAC,eAAe,IAAA,cAAmB,GAAG;CAC7D,IAAI,mBAAmB,OAAO;CAE9B,IAAI,oBAAoB;EAAE;EAAgB;EAAU,QAAQ;EAAS;CAAW,CAAC,GAC/E;CAGF,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,YAAY,CAAC;AACvD;;;;;AAMA,SAAgB,gBAAgB,MAKvB;CACP,kBAAkB;EAAE,GAAG;EAAM,QAAQ;CAAO,CAAC;AAC/C"}
+{"version":3,"file":"authorship.cjs","names":["MASTRA_RESOURCE_ID_KEY","MASTRA_USER_KEY","MASTRA_USER_PERMISSIONS_KEY","matchesPermission","HTTPException"],"sources":["../../../src/server/handlers/authorship.ts"],"sourcesContent":["import { matchesPermission } from '@mastra/core/auth/ee';\nimport type { RequestContext } from '@mastra/core/di';\n\nimport { MASTRA_RESOURCE_ID_KEY, MASTRA_USER_KEY, MASTRA_USER_PERMISSIONS_KEY } from '../constants';\nimport { HTTPException } from '../http-exception';\n\n/**\n * Shape of a stored record that carries ownership + visibility metadata.\n * Used by `matchesAuthorFilter` and the access-assertion helpers.\n */\nexport type OwnedRecord = {\n  authorId?: string | null;\n  visibility?: 'private' | 'public';\n};\n\n/**\n * Returns the author id associated with the authenticated caller, or `null`\n * if auth is not configured / the caller cannot be resolved.\n *\n * Prefers `MASTRA_RESOURCE_ID_KEY` (set by `authConfig.mapUserToResourceId`)\n * and falls back to `user.id` on the authenticated user object.\n */\nexport function getCallerAuthorId(requestContext: RequestContext): string | null {\n  const resourceId = requestContext.get(MASTRA_RESOURCE_ID_KEY);\n  if (typeof resourceId === 'string' && resourceId.length > 0) {\n    return resourceId;\n  }\n\n  const user = requestContext.get(MASTRA_USER_KEY);\n  if (user && typeof user === 'object' && 'id' in user) {\n    const id = user.id;\n    if (typeof id === 'string' && id.length > 0) {\n      return id;\n    }\n  }\n\n  return null;\n}\n\n/**\n * Returns the list of permission strings currently attached to the caller by\n * the RBAC provider. Returns an empty array when RBAC isn't configured.\n */\nexport function getCallerPermissions(requestContext: RequestContext): string[] {\n  const raw = requestContext.get(MASTRA_USER_PERMISSIONS_KEY);\n  if (Array.isArray(raw)) {\n    return raw.filter((p): p is string => typeof p === 'string');\n  }\n  return [];\n}\n\n/**\n * True if the caller holds a wildcard permission that lets them manage a\n * resource they don't own (e.g. admins listing agents across tenants).\n *\n * Recognizes `*`, `<resource>:*`, and `<resource>:admin`.\n */\nexport function hasAdminBypass(requestContext: RequestContext, resource: string): boolean {\n  const permissions = getCallerPermissions(requestContext);\n  if (permissions.length === 0) return false;\n  const wildcardAll = '*';\n  const resourceWildcard = `${resource}:*`;\n  const resourceAdmin = `${resource}:admin`;\n  return permissions.some(p => p === wildcardAll || p === resourceWildcard || p === resourceAdmin);\n}\n\n/**\n * True if the caller holds a permission explicitly scoped to a specific\n * resource id — e.g. `agents:read:agent-123` or `agents:*:agent-123`.\n *\n * Broad grants without a resource-id segment (e.g. the role-default\n * `agents:execute`) are intentionally NOT treated as satisfying ownership\n * overrides. Those broad grants already gate route access at the\n * `requiresPermission` layer; giving them a second life as per-record\n * overrides would defeat the owner/visibility model.\n *\n * When called without `resourceId` (the legacy shape), falls back to the\n * original \"any matching permission\" behavior.\n */\nexport function hasScopedPermission(args: {\n  requestContext: RequestContext;\n  resource: string;\n  action: string;\n  resourceId?: string;\n}): boolean {\n  const { requestContext, resource, action, resourceId } = args;\n  const permissions = getCallerPermissions(requestContext);\n  if (permissions.length === 0) return false;\n\n  if (!resourceId) {\n    const required = `${resource}:${action}`;\n    return permissions.some(p => matchesPermission(p, required));\n  }\n\n  const required = `${resource}:${action}:${resourceId}`;\n  return permissions.some(p => {\n    // Only honor grants that explicitly name a resource id. A granted\n    // permission with just `<resource>:<action>` (no id segment) is\n    // considered a broad role grant, not a per-record override.\n    const parts = p.split(':');\n    if (parts.length < 3) return false;\n    return matchesPermission(p, required);\n  });\n}\n\nexport type AuthorFilter =\n  | { kind: 'unrestricted' }\n  | { kind: 'exact'; authorId: string }\n  | { kind: 'ownedOrPublic'; callerAuthorId: string }\n  | { kind: 'publicOnly' }\n  | { kind: 'ownedOrPublicOthers'; callerAuthorId: string; queryAuthorId: string };\n\n/**\n * Resolves the filter to apply when listing owner-scoped records.\n *\n * Behavior matrix:\n * - Admin bypass + no query overrides           → `unrestricted`.\n * - Admin bypass + `authorId=X`                 → `exact` (all of X's rows).\n * - `visibility=public` (any caller)            → `publicOnly` (aggregate public rows across owners).\n * - `authorId=X`, caller === X                  → `exact` (all of caller's rows).\n * - `authorId=X`, caller !== X (non-admin)      → `ownedOrPublicOthers` (only X's public rows).\n * - No caller (auth off)                        → `unrestricted` (or `exact` if query supplied).\n * - Default                                     → `ownedOrPublic` (caller's rows + legacy unowned + any public rows).\n */\nexport function resolveAuthorFilter(args: {\n  requestContext: RequestContext;\n  resource: string;\n  queryAuthorId?: string;\n  queryVisibility?: 'public';\n}): AuthorFilter {\n  const { requestContext, resource, queryAuthorId, queryVisibility } = args;\n  const callerAuthorId = getCallerAuthorId(requestContext);\n  const bypass = hasAdminBypass(requestContext, resource);\n\n  if (queryVisibility === 'public' && !queryAuthorId) {\n    return { kind: 'publicOnly' };\n  }\n\n  if (bypass) {\n    return queryAuthorId ? { kind: 'exact', authorId: queryAuthorId } : { kind: 'unrestricted' };\n  }\n\n  // Auth isn't configured (no caller) → treat as unrestricted. The route's\n  // `requiresAuth`/`requiresPermission` is what gates access in that mode.\n  if (!callerAuthorId) {\n    return queryAuthorId ? { kind: 'exact', authorId: queryAuthorId } : { kind: 'unrestricted' };\n  }\n\n  if (queryAuthorId) {\n    if (queryAuthorId === callerAuthorId) {\n      return { kind: 'exact', authorId: callerAuthorId };\n    }\n    // Non-owner asking about another user: only that user's public rows are visible.\n    return { kind: 'ownedOrPublicOthers', callerAuthorId, queryAuthorId };\n  }\n\n  return { kind: 'ownedOrPublic', callerAuthorId };\n}\n\n/**\n * Returns `true` if the record is visible to the caller given the resolved\n * filter. See `resolveAuthorFilter` for the filter semantics.\n *\n * Legacy rows with `authorId == null` are treated as public (visible to all).\n */\nexport function matchesAuthorFilter(record: OwnedRecord, filter: AuthorFilter): boolean {\n  const owner = record.authorId ?? null;\n  const isPublic = record.visibility === 'public';\n\n  switch (filter.kind) {\n    case 'unrestricted':\n      return true;\n    case 'exact':\n      return owner === filter.authorId;\n    case 'ownedOrPublic':\n      return owner === null || owner === filter.callerAuthorId || isPublic;\n    case 'publicOnly':\n      return owner === null || isPublic;\n    case 'ownedOrPublicOthers':\n      // Filtering by another author's rows: only expose their public ones.\n      // Legacy unowned rows match if the query is for `null`; here the query\n      // is always for a concrete id, so unowned rows don't match.\n      return owner === filter.queryAuthorId && isPublic;\n  }\n}\n\n/**\n * Asserts the caller has read access to the record. Throws 404 if not.\n *\n * Read access is granted when:\n * - The record has no owner (legacy/public), OR\n * - The record is marked `visibility: 'public'`, OR\n * - The caller owns the record, OR\n * - The caller has admin bypass (`*`, `<resource>:*`, `<resource>:admin`), OR\n * - The caller holds `<resource>:read` or `<resource>:read:<resourceId>`.\n */\nexport function assertReadAccess(args: {\n  requestContext: RequestContext;\n  resource: string;\n  resourceId?: string;\n  record: OwnedRecord;\n}): void {\n  const { requestContext, resource, resourceId, record } = args;\n  const owner = record.authorId ?? null;\n\n  if (owner === null) return;\n  if (record.visibility === 'public') return;\n  if (hasAdminBypass(requestContext, resource)) return;\n\n  const callerAuthorId = getCallerAuthorId(requestContext);\n  // No authenticated user on the request context means auth is not configured\n  // (single-user/dev mode). When auth IS configured, coreAuthMiddleware\n  // rejects unauthenticated requests with 401 before they reach handlers,\n  // so an absent user here genuinely means no auth provider.\n  if (!callerAuthorId && !requestContext.get(MASTRA_USER_KEY)) return;\n  if (callerAuthorId === owner) return;\n\n  if (hasScopedPermission({ requestContext, resource, action: 'read', resourceId })) {\n    return;\n  }\n\n  throw new HTTPException(404, { message: 'Not found' });\n}\n\n/**\n * Asserts the caller has execute access to the record. Throws 404 if not.\n *\n * Execute access is granted when:\n * - The record has no owner (legacy/public), OR\n * - The record is marked `visibility: 'public'`, OR\n * - The caller owns the record, OR\n * - The caller has admin bypass (`*`, `<resource>:*`, `<resource>:admin`), OR\n * - The caller holds `<resource>:execute` / `<resource>:execute:<resourceId>`, OR\n * - The caller holds `<resource>:read` / `<resource>:read:<resourceId>`\n *   (read implies the ability to consume/chat with the resource).\n */\nexport function assertExecuteAccess(args: {\n  requestContext: RequestContext;\n  resource: string;\n  resourceId?: string;\n  record: OwnedRecord;\n}): void {\n  const { requestContext, resource, resourceId, record } = args;\n  const owner = record.authorId ?? null;\n\n  if (owner === null) return;\n  if (record.visibility === 'public') return;\n  if (hasAdminBypass(requestContext, resource)) return;\n\n  const callerAuthorId = getCallerAuthorId(requestContext);\n  if (!callerAuthorId && !requestContext.get(MASTRA_USER_KEY)) return; // No auth configured (see assertReadAccess)\n  if (callerAuthorId === owner) return;\n\n  if (hasScopedPermission({ requestContext, resource, action: 'execute', resourceId })) {\n    return;\n  }\n  if (hasScopedPermission({ requestContext, resource, action: 'read', resourceId })) {\n    return;\n  }\n\n  throw new HTTPException(404, { message: 'Not found' });\n}\n\n/**\n * Asserts the caller has write access (edit or delete) to the record.\n * Throws 404 if not.\n *\n * Write access is granted when:\n * - The record has no owner (legacy), OR\n * - The caller owns the record, OR\n * - The caller has admin bypass, OR\n * - The caller holds `<resource>:<action>` or `<resource>:<action>:<resourceId>`.\n *\n * `visibility: 'public'` alone does NOT grant write access.\n */\nexport function assertWriteAccess(args: {\n  requestContext: RequestContext;\n  resource: string;\n  resourceId?: string;\n  action: 'edit' | 'delete' | 'write';\n  record: OwnedRecord;\n}): void {\n  const { requestContext, resource, resourceId, action, record } = args;\n  const owner = record.authorId ?? null;\n\n  if (owner === null) return;\n  if (hasAdminBypass(requestContext, resource)) return;\n\n  const callerAuthorId = getCallerAuthorId(requestContext);\n  if (!callerAuthorId && !requestContext.get(MASTRA_USER_KEY)) return; // No auth configured (see assertReadAccess)\n  if (callerAuthorId === owner) return;\n\n  if (hasScopedPermission({ requestContext, resource, action, resourceId })) {\n    return;\n  }\n\n  throw new HTTPException(404, { message: 'Not found' });\n}\n\n/**\n * Asserts the caller has share access to the record. Throws 404 if not.\n *\n * Share access controls who can change a record's audience/visibility\n * (e.g. flipping `private` ↔ `public`). It is intentionally separate from\n * `write`: a caller with only `<resource>:write` MUST NOT be able to flip\n * visibility — that would let any editor expose private records.\n *\n * Share access is granted when:\n * - The record has no owner (legacy), OR\n * - The caller owns the record (creators can share their own records), OR\n * - The caller has admin bypass (`*`, `<resource>:*`, `<resource>:admin`), OR\n * - The caller holds `<resource>:share` / `<resource>:share:<resourceId>`\n *   (or any pattern that matches it, e.g. `*:share`).\n *\n * `visibility: 'public'` does NOT grant share access — being readable doesn't\n * imply the right to change who else can read.\n */\nexport function assertShareAccess(args: {\n  requestContext: RequestContext;\n  resource: string;\n  resourceId?: string;\n  record: OwnedRecord;\n}): void {\n  const { requestContext, resource, resourceId, record } = args;\n  const owner = record.authorId ?? null;\n\n  if (owner === null) return;\n  if (hasAdminBypass(requestContext, resource)) return;\n\n  const callerAuthorId = getCallerAuthorId(requestContext);\n  if (!callerAuthorId && !requestContext.get(MASTRA_USER_KEY)) return; // No auth configured (see assertReadAccess)\n  if (callerAuthorId === owner) return;\n\n  if (hasScopedPermission({ requestContext, resource, action: 'share', resourceId })) {\n    return;\n  }\n\n  throw new HTTPException(404, { message: 'Not found' });\n}\n\n/**\n * Alias for `assertWriteAccess` with `action: 'edit'`. Prefer `assertWriteAccess`\n * in new code so the action is explicit.\n */\nexport function assertOwnership(args: {\n  requestContext: RequestContext;\n  resource: string;\n  resourceId?: string;\n  record: OwnedRecord;\n}): void {\n  assertWriteAccess({ ...args, action: 'edit' });\n}\n"],"mappings":";;;;;;;;;;;;;AAsBA,SAAgB,kBAAkB,gBAA+C;CAC/E,MAAM,aAAa,eAAe,IAAIA,kBAAAA,sBAAsB;CAC5D,IAAI,OAAO,eAAe,YAAY,WAAW,SAAS,GACxD,OAAO;CAGT,MAAM,OAAO,eAAe,IAAIC,kBAAAA,eAAe;CAC/C,IAAI,QAAQ,OAAO,SAAS,YAAY,QAAQ,MAAM;EACpD,MAAM,KAAK,KAAK;EAChB,IAAI,OAAO,OAAO,YAAY,GAAG,SAAS,GACxC,OAAO;CAEX;CAEA,OAAO;AACT;;;;;AAMA,SAAgB,qBAAqB,gBAA0C;CAC7E,MAAM,MAAM,eAAe,IAAIC,kBAAAA,2BAA2B;CAC1D,IAAI,MAAM,QAAQ,GAAG,GACnB,OAAO,IAAI,QAAQ,MAAmB,OAAO,MAAM,QAAQ;CAE7D,OAAO,CAAC;AACV;;;;;;;AAQA,SAAgB,eAAe,gBAAgC,UAA2B;CACxF,MAAM,cAAc,qBAAqB,cAAc;CACvD,IAAI,YAAY,WAAW,GAAG,OAAO;CACrC,MAAM,cAAc;CACpB,MAAM,mBAAmB,GAAG,SAAS;CACrC,MAAM,gBAAgB,GAAG,SAAS;CAClC,OAAO,YAAY,MAAK,MAAK,MAAM,eAAe,MAAM,oBAAoB,MAAM,aAAa;AACjG;;;;;;;;;;;;;;AAeA,SAAgB,oBAAoB,MAKxB;CACV,MAAM,EAAE,gBAAgB,UAAU,QAAQ,eAAe;CACzD,MAAM,cAAc,qBAAqB,cAAc;CACvD,IAAI,YAAY,WAAW,GAAG,OAAO;CAErC,IAAI,CAAC,YAAY;EACf,MAAM,WAAW,GAAG,SAAS,GAAG;EAChC,OAAO,YAAY,MAAK,OAAA,GAAKC,qBAAAA,kBAAAA,CAAkB,GAAG,QAAQ,CAAC;CAC7D;CAEA,MAAM,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG;CAC1C,OAAO,YAAY,MAAK,MAAK;EAK3B,IADc,EAAE,MAAM,GACd,CAAC,CAAC,SAAS,GAAG,OAAO;EAC7B,QAAA,GAAOA,qBAAAA,kBAAAA,CAAkB,GAAG,QAAQ;CACtC,CAAC;AACH;;;;;;;;;;;;;AAqBA,SAAgB,oBAAoB,MAKnB;CACf,MAAM,EAAE,gBAAgB,UAAU,eAAe,oBAAoB;CACrE,MAAM,iBAAiB,kBAAkB,cAAc;CACvD,MAAM,SAAS,eAAe,gBAAgB,QAAQ;CAEtD,IAAI,oBAAoB,YAAY,CAAC,eACnC,OAAO,EAAE,MAAM,aAAa;CAG9B,IAAI,QACF,OAAO,gBAAgB;EAAE,MAAM;EAAS,UAAU;CAAc,IAAI,EAAE,MAAM,eAAe;CAK7F,IAAI,CAAC,gBACH,OAAO,gBAAgB;EAAE,MAAM;EAAS,UAAU;CAAc,IAAI,EAAE,MAAM,eAAe;CAG7F,IAAI,eAAe;EACjB,IAAI,kBAAkB,gBACpB,OAAO;GAAE,MAAM;GAAS,UAAU;EAAe;EAGnD,OAAO;GAAE,MAAM;GAAuB;GAAgB;EAAc;CACtE;CAEA,OAAO;EAAE,MAAM;EAAiB;CAAe;AACjD;;;;;;;AAQA,SAAgB,oBAAoB,QAAqB,QAA+B;CACtF,MAAM,QAAQ,OAAO,YAAY;CACjC,MAAM,WAAW,OAAO,eAAe;CAEvC,QAAQ,OAAO,MAAf;EACE,KAAK,gBACH,OAAO;EACT,KAAK,SACH,OAAO,UAAU,OAAO;EAC1B,KAAK,iBACH,OAAO,UAAU,QAAQ,UAAU,OAAO,kBAAkB;EAC9D,KAAK,cACH,OAAO,UAAU,QAAQ;EAC3B,KAAK,uBAIH,OAAO,UAAU,OAAO,iBAAiB;CAC7C;AACF;;;;;;;;;;;AAYA,SAAgB,iBAAiB,MAKxB;CACP,MAAM,EAAE,gBAAgB,UAAU,YAAY,WAAW;CACzD,MAAM,QAAQ,OAAO,YAAY;CAEjC,IAAI,UAAU,MAAM;CACpB,IAAI,OAAO,eAAe,UAAU;CACpC,IAAI,eAAe,gBAAgB,QAAQ,GAAG;CAE9C,MAAM,iBAAiB,kBAAkB,cAAc;CAKvD,IAAI,CAAC,kBAAkB,CAAC,eAAe,IAAA,cAAmB,GAAG;CAC7D,IAAI,mBAAmB,OAAO;CAE9B,IAAI,oBAAoB;EAAE;EAAgB;EAAU,QAAQ;EAAQ;CAAW,CAAC,GAC9E;CAGF,MAAM,IAAIC,uBAAAA,cAAc,KAAK,EAAE,SAAS,YAAY,CAAC;AACvD;;;;;;;;;;;;;AAcA,SAAgB,oBAAoB,MAK3B;CACP,MAAM,EAAE,gBAAgB,UAAU,YAAY,WAAW;CACzD,MAAM,QAAQ,OAAO,YAAY;CAEjC,IAAI,UAAU,MAAM;CACpB,IAAI,OAAO,eAAe,UAAU;CACpC,IAAI,eAAe,gBAAgB,QAAQ,GAAG;CAE9C,MAAM,iBAAiB,kBAAkB,cAAc;CACvD,IAAI,CAAC,kBAAkB,CAAC,eAAe,IAAA,cAAmB,GAAG;CAC7D,IAAI,mBAAmB,OAAO;CAE9B,IAAI,oBAAoB;EAAE;EAAgB;EAAU,QAAQ;EAAW;CAAW,CAAC,GACjF;CAEF,IAAI,oBAAoB;EAAE;EAAgB;EAAU,QAAQ;EAAQ;CAAW,CAAC,GAC9E;CAGF,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,YAAY,CAAC;AACvD;;;;;;;;;;;;;AAcA,SAAgB,kBAAkB,MAMzB;CACP,MAAM,EAAE,gBAAgB,UAAU,YAAY,QAAQ,WAAW;CACjE,MAAM,QAAQ,OAAO,YAAY;CAEjC,IAAI,UAAU,MAAM;CACpB,IAAI,eAAe,gBAAgB,QAAQ,GAAG;CAE9C,MAAM,iBAAiB,kBAAkB,cAAc;CACvD,IAAI,CAAC,kBAAkB,CAAC,eAAe,IAAA,cAAmB,GAAG;CAC7D,IAAI,mBAAmB,OAAO;CAE9B,IAAI,oBAAoB;EAAE;EAAgB;EAAU;EAAQ;CAAW,CAAC,GACtE;CAGF,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,YAAY,CAAC;AACvD;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,kBAAkB,MAKzB;CACP,MAAM,EAAE,gBAAgB,UAAU,YAAY,WAAW;CACzD,MAAM,QAAQ,OAAO,YAAY;CAEjC,IAAI,UAAU,MAAM;CACpB,IAAI,eAAe,gBAAgB,QAAQ,GAAG;CAE9C,MAAM,iBAAiB,kBAAkB,cAAc;CACvD,IAAI,CAAC,kBAAkB,CAAC,eAAe,IAAA,cAAmB,GAAG;CAC7D,IAAI,mBAAmB,OAAO;CAE9B,IAAI,oBAAoB;EAAE;EAAgB;EAAU,QAAQ;EAAS;CAAW,CAAC,GAC/E;CAGF,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,YAAY,CAAC;AACvD;;;;;AAMA,SAAgB,gBAAgB,MAKvB;CACP,kBAAkB;EAAE,GAAG;EAAM,QAAQ;CAAO,CAAC;AAC/C"}

package/dist/server/handlers/background-tasks.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-require("../../rolldown-runtime-Bd6kNlEP.cjs");
-const require_background_tasks = require("../../background-tasks-CabImVak.cjs");
+require("../../rolldown-runtime-BwC_XMyb.cjs");
+const require_background_tasks = require("../../background-tasks-B3VAKTJh.cjs");
 exports.BACKGROUND_TASK_STREAM_ROUTE = require_background_tasks.BACKGROUND_TASK_STREAM_ROUTE;
 exports.GET_BACKGROUND_TASK_ROUTE = require_background_tasks.GET_BACKGROUND_TASK_ROUTE;
 exports.LIST_BACKGROUND_TASKS_ROUTE = require_background_tasks.LIST_BACKGROUND_TASKS_ROUTE;

package/dist/server/handlers/background-tasks.js

@@ -1,2 +1 @@
-import { n as GET_BACKGROUND_TASK_ROUTE, r as LIST_BACKGROUND_TASKS_ROUTE, t as BACKGROUND_TASK_STREAM_ROUTE } from "../../background-tasks-oBaLtnCn.js";
-export { BACKGROUND_TASK_STREAM_ROUTE, GET_BACKGROUND_TASK_ROUTE, LIST_BACKGROUND_TASKS_ROUTE };
+export { t as BACKGROUND_TASK_STREAM_ROUTE, n as GET_BACKGROUND_TASK_ROUTE, r as LIST_BACKGROUND_TASKS_ROUTE } from "../../background-tasks-Du2zYOPl.js";

package/dist/server/handlers/builder-registry.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-require("../../rolldown-runtime-Bd6kNlEP.cjs");
-const require_builder_registry = require("../../builder-registry-D0frV8lQ.cjs");
+require("../../rolldown-runtime-BwC_XMyb.cjs");
+const require_builder_registry = require("../../builder-registry-DaFAaMTf.cjs");
 exports.BUILDER_REGISTRY_INSTALL_ROUTE = require_builder_registry.BUILDER_REGISTRY_INSTALL_ROUTE;
 exports.BUILDER_REGISTRY_POPULAR_ROUTE = require_builder_registry.BUILDER_REGISTRY_POPULAR_ROUTE;
 exports.BUILDER_REGISTRY_PREVIEW_ROUTE = require_builder_registry.BUILDER_REGISTRY_PREVIEW_ROUTE;

package/dist/server/handlers/builder-registry.js

@@ -1,2 +1 @@
-import { a as LIST_BUILDER_REGISTRIES_ROUTE, i as BUILDER_REGISTRY_SEARCH_ROUTE, n as BUILDER_REGISTRY_POPULAR_ROUTE, r as BUILDER_REGISTRY_PREVIEW_ROUTE, t as BUILDER_REGISTRY_INSTALL_ROUTE } from "../../builder-registry-DOkLe8ES.js";
-export { BUILDER_REGISTRY_INSTALL_ROUTE, BUILDER_REGISTRY_POPULAR_ROUTE, BUILDER_REGISTRY_PREVIEW_ROUTE, BUILDER_REGISTRY_SEARCH_ROUTE, LIST_BUILDER_REGISTRIES_ROUTE };
+export { t as BUILDER_REGISTRY_INSTALL_ROUTE, n as BUILDER_REGISTRY_POPULAR_ROUTE, r as BUILDER_REGISTRY_PREVIEW_ROUTE, i as BUILDER_REGISTRY_SEARCH_ROUTE, a as LIST_BUILDER_REGISTRIES_ROUTE } from "../../builder-registry-DLdu9bWH.js";

package/dist/server/handlers/channels.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-require("../../rolldown-runtime-Bd6kNlEP.cjs");
-const require_channels = require("../../channels-CBIopVWd.cjs");
+require("../../rolldown-runtime-BwC_XMyb.cjs");
+const require_channels = require("../../channels-BnVRmnzK.cjs");
 exports.CONNECT_CHANNEL_ROUTE = require_channels.CONNECT_CHANNEL_ROUTE;
 exports.DISCONNECT_CHANNEL_ROUTE = require_channels.DISCONNECT_CHANNEL_ROUTE;
 exports.LIST_CHANNEL_INSTALLATIONS_ROUTE = require_channels.LIST_CHANNEL_INSTALLATIONS_ROUTE;

package/dist/server/handlers/channels.js

@@ -1,2 +1 @@
-import { a as RECONCILE_CHANNEL_ROUTE, i as LIST_CHANNEL_PLATFORMS_ROUTE, n as DISCONNECT_CHANNEL_ROUTE, r as LIST_CHANNEL_INSTALLATIONS_ROUTE, t as CONNECT_CHANNEL_ROUTE } from "../../channels-BOxgHvzI.js";
-export { CONNECT_CHANNEL_ROUTE, DISCONNECT_CHANNEL_ROUTE, LIST_CHANNEL_INSTALLATIONS_ROUTE, LIST_CHANNEL_PLATFORMS_ROUTE, RECONCILE_CHANNEL_ROUTE };
+export { t as CONNECT_CHANNEL_ROUTE, n as DISCONNECT_CHANNEL_ROUTE, r as LIST_CHANNEL_INSTALLATIONS_ROUTE, i as LIST_CHANNEL_PLATFORMS_ROUTE, a as RECONCILE_CHANNEL_ROUTE } from "../../channels-Db-4pXVZ.js";

package/dist/server/handlers/conversations.cjs

@@ -1,172 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_rolldown_runtime = require("../../rolldown-runtime-Bd6kNlEP.cjs");
-const require_http_exception = require("../../http-exception-CKDHupKw.cjs");
-const require_route_builder = require("../../route-builder-BNZs643f.cjs");
-const require_server_handlers_error = require("./error.cjs");
-const require_utils = require("../../utils-Du-EpvDs.cjs");
-const require_server_handlers_agents = require("./agents.cjs");
-const require_conversations = require("../../conversations-Bj5TLNqF.cjs");
-const require_server_handlers_responses_adapter = require("./responses.adapter.cjs");
-const require_server_handlers_responses_storage = require("./responses.storage.cjs");
-//#region src/server/handlers/conversations.ts
-var conversations_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
-	CREATE_CONVERSATION_ROUTE: () => CREATE_CONVERSATION_ROUTE,
-	DELETE_CONVERSATION_ROUTE: () => DELETE_CONVERSATION_ROUTE,
-	GET_CONVERSATION_ITEMS_ROUTE: () => GET_CONVERSATION_ITEMS_ROUTE,
-	GET_CONVERSATION_ROUTE: () => GET_CONVERSATION_ROUTE
-});
-function buildConversationObject({ thread }) {
-	return {
-		id: thread.id,
-		object: "conversation",
-		thread
-	};
-}
-function buildConversationItemsList(items) {
-	return {
-		object: "list",
-		data: items,
-		first_id: items[0]?.id ?? null,
-		last_id: items.at(-1)?.id ?? null,
-		has_more: false
-	};
-}
-function buildConversationDeleted(conversationId) {
-	return {
-		id: conversationId,
-		object: "conversation.deleted",
-		deleted: true
-	};
-}
-const CREATE_CONVERSATION_ROUTE = require_route_builder.createRoute({
-	method: "POST",
-	path: "/v1/conversations",
-	responseType: "json",
-	bodySchema: require_conversations.createConversationBodySchema,
-	responseSchema: require_conversations.conversationObjectSchema,
-	summary: "Create a conversation",
-	description: "Creates a new thread-backed conversation for agent-backed Responses API requests",
-	tags: ["Responses"],
-	requiresAuth: true,
-	requiresPermission: require_utils.MastraFGAPermissions.AGENTS_CREATE,
-	handler: async ({ mastra, requestContext, agent_id, conversation_id, resource_id, title, metadata }) => {
-		try {
-			if (!mastra) throw new require_http_exception.HTTPException(500, { message: "Mastra instance is required for conversations" });
-			const agent = await require_server_handlers_agents.getAgentFromSystem({
-				mastra,
-				agentId: agent_id
-			});
-			const memory = await agent.getMemory({ requestContext });
-			if (!memory) throw new require_http_exception.HTTPException(400, { message: `Agent "${agent.id}" does not have memory configured` });
-			if (!await require_server_handlers_responses_storage.getAgentMemoryStore({
-				agent,
-				requestContext
-			})) throw new require_http_exception.HTTPException(400, { message: `Memory storage is not configured for agent "${agent.id}"` });
-			const threadId = conversation_id ?? globalThis.crypto.randomUUID();
-			const resourceId = require_utils.getEffectiveResourceId(requestContext, resource_id) ?? threadId;
-			if (conversation_id) await require_utils.validateThreadOwnership(await memory.getThreadById({ threadId }), require_utils.getEffectiveResourceId(requestContext, void 0));
-			return buildConversationObject({ thread: await memory.createThread({
-				threadId,
-				resourceId,
-				title,
-				metadata
-			}) });
-		} catch (error) {
-			return require_server_handlers_error.handleError(error, "Error creating conversation");
-		}
-	}
-});
-const GET_CONVERSATION_ROUTE = require_route_builder.createRoute({
-	method: "GET",
-	path: "/v1/conversations/:conversationId",
-	responseType: "json",
-	pathParamSchema: require_conversations.conversationIdPathParams,
-	responseSchema: require_conversations.conversationObjectSchema,
-	summary: "Retrieve a conversation",
-	description: "Returns a conversation object backed by a Mastra memory thread",
-	tags: ["Responses"],
-	requiresAuth: true,
-	requiresPermission: require_utils.MastraFGAPermissions.AGENTS_READ,
-	handler: async ({ mastra, requestContext, conversationId }) => {
-		try {
-			const match = await require_server_handlers_responses_storage.findConversationThreadAcrossAgents({
-				mastra,
-				conversationId,
-				requestContext
-			});
-			if (!match) throw new require_http_exception.HTTPException(404, { message: `Conversation ${conversationId} was not found` });
-			return buildConversationObject({ thread: match.thread });
-		} catch (error) {
-			return require_server_handlers_error.handleError(error, "Error retrieving conversation");
-		}
-	}
-});
-const GET_CONVERSATION_ITEMS_ROUTE = require_route_builder.createRoute({
-	method: "GET",
-	path: "/v1/conversations/:conversationId/items",
-	responseType: "json",
-	pathParamSchema: require_conversations.conversationIdPathParams,
-	responseSchema: require_conversations.conversationItemsListSchema,
-	summary: "List conversation items",
-	description: "Returns OpenAI-style conversation items derived from the stored thread messages",
-	tags: ["Responses"],
-	requiresAuth: true,
-	requiresPermission: require_utils.MastraFGAPermissions.AGENTS_READ,
-	handler: async ({ mastra, requestContext, conversationId }) => {
-		try {
-			const match = await require_server_handlers_responses_storage.findConversationThreadAcrossAgents({
-				mastra,
-				conversationId,
-				requestContext
-			});
-			if (!match) throw new require_http_exception.HTTPException(404, { message: `Conversation ${conversationId} was not found` });
-			const { messages } = await match.memoryStore.listMessages({
-				threadId: conversationId,
-				page: 0,
-				perPage: 1e3
-			});
-			return buildConversationItemsList(require_server_handlers_responses_adapter.mapMastraMessagesToConversationItems(messages));
-		} catch (error) {
-			return require_server_handlers_error.handleError(error, "Error retrieving conversation");
-		}
-	}
-});
-const DELETE_CONVERSATION_ROUTE = require_route_builder.createRoute({
-	method: "DELETE",
-	path: "/v1/conversations/:conversationId",
-	responseType: "json",
-	pathParamSchema: require_conversations.conversationIdPathParams,
-	responseSchema: require_conversations.conversationDeletedSchema,
-	summary: "Delete a conversation",
-	description: "Deletes a thread-backed conversation and its stored items",
-	tags: ["Responses"],
-	requiresAuth: true,
-	requiresPermission: require_utils.MastraFGAPermissions.AGENTS_DELETE,
-	handler: async ({ mastra, requestContext, conversationId }) => {
-		try {
-			const match = await require_server_handlers_responses_storage.findConversationThreadAcrossAgents({
-				mastra,
-				conversationId,
-				requestContext
-			});
-			if (!match) throw new require_http_exception.HTTPException(404, { message: `Conversation ${conversationId} was not found` });
-			await match.memoryStore.deleteThread({ threadId: conversationId });
-			return buildConversationDeleted(conversationId);
-		} catch (error) {
-			return require_server_handlers_error.handleError(error, "Error deleting conversation");
-		}
-	}
-});
-//#endregion
-exports.CREATE_CONVERSATION_ROUTE = CREATE_CONVERSATION_ROUTE;
-exports.DELETE_CONVERSATION_ROUTE = DELETE_CONVERSATION_ROUTE;
-exports.GET_CONVERSATION_ITEMS_ROUTE = GET_CONVERSATION_ITEMS_ROUTE;
-exports.GET_CONVERSATION_ROUTE = GET_CONVERSATION_ROUTE;
-Object.defineProperty(exports, "conversations_exports", {
-	enumerable: true,
-	get: function() {
-		return conversations_exports;
-	}
-});
-
-//# sourceMappingURL=conversations.cjs.map
+require("../../rolldown-runtime-BwC_XMyb.cjs");
+const require_conversations = require("../../conversations-C5MkQBB8.cjs");
+exports.CREATE_CONVERSATION_ROUTE = require_conversations.CREATE_CONVERSATION_ROUTE;
+exports.DELETE_CONVERSATION_ROUTE = require_conversations.DELETE_CONVERSATION_ROUTE;
+exports.GET_CONVERSATION_ITEMS_ROUTE = require_conversations.GET_CONVERSATION_ITEMS_ROUTE;
+exports.GET_CONVERSATION_ROUTE = require_conversations.GET_CONVERSATION_ROUTE;

package/dist/server/handlers/conversations.js

@@ -1,162 +1 @@
-import { r as __exportAll } from "../../rolldown-runtime-maW3aOIk.js";
-import { t as HTTPException } from "../../http-exception-CyfxZB6W.js";
-import { n as createRoute } from "../../route-builder-BfQYtclb.js";
-import { handleError } from "./error.js";
-import { g as MastraFGAPermissions, h as validateThreadOwnership, i as getEffectiveResourceId } from "../../utils-BBJlS81s.js";
-import { getAgentFromSystem } from "./agents.js";
-import { a as createConversationBodySchema, i as conversationObjectSchema, n as conversationIdPathParams, r as conversationItemsListSchema, t as conversationDeletedSchema } from "../../conversations-BzBHVFYe.js";
-import { mapMastraMessagesToConversationItems } from "./responses.adapter.js";
-import { findConversationThreadAcrossAgents, getAgentMemoryStore } from "./responses.storage.js";
-//#region src/server/handlers/conversations.ts
-var conversations_exports = /* @__PURE__ */ __exportAll({
-	CREATE_CONVERSATION_ROUTE: () => CREATE_CONVERSATION_ROUTE,
-	DELETE_CONVERSATION_ROUTE: () => DELETE_CONVERSATION_ROUTE,
-	GET_CONVERSATION_ITEMS_ROUTE: () => GET_CONVERSATION_ITEMS_ROUTE,
-	GET_CONVERSATION_ROUTE: () => GET_CONVERSATION_ROUTE
-});
-function buildConversationObject({ thread }) {
-	return {
-		id: thread.id,
-		object: "conversation",
-		thread
-	};
-}
-function buildConversationItemsList(items) {
-	return {
-		object: "list",
-		data: items,
-		first_id: items[0]?.id ?? null,
-		last_id: items.at(-1)?.id ?? null,
-		has_more: false
-	};
-}
-function buildConversationDeleted(conversationId) {
-	return {
-		id: conversationId,
-		object: "conversation.deleted",
-		deleted: true
-	};
-}
-const CREATE_CONVERSATION_ROUTE = createRoute({
-	method: "POST",
-	path: "/v1/conversations",
-	responseType: "json",
-	bodySchema: createConversationBodySchema,
-	responseSchema: conversationObjectSchema,
-	summary: "Create a conversation",
-	description: "Creates a new thread-backed conversation for agent-backed Responses API requests",
-	tags: ["Responses"],
-	requiresAuth: true,
-	requiresPermission: MastraFGAPermissions.AGENTS_CREATE,
-	handler: async ({ mastra, requestContext, agent_id, conversation_id, resource_id, title, metadata }) => {
-		try {
-			if (!mastra) throw new HTTPException(500, { message: "Mastra instance is required for conversations" });
-			const agent = await getAgentFromSystem({
-				mastra,
-				agentId: agent_id
-			});
-			const memory = await agent.getMemory({ requestContext });
-			if (!memory) throw new HTTPException(400, { message: `Agent "${agent.id}" does not have memory configured` });
-			if (!await getAgentMemoryStore({
-				agent,
-				requestContext
-			})) throw new HTTPException(400, { message: `Memory storage is not configured for agent "${agent.id}"` });
-			const threadId = conversation_id ?? globalThis.crypto.randomUUID();
-			const resourceId = getEffectiveResourceId(requestContext, resource_id) ?? threadId;
-			if (conversation_id) await validateThreadOwnership(await memory.getThreadById({ threadId }), getEffectiveResourceId(requestContext, void 0));
-			return buildConversationObject({ thread: await memory.createThread({
-				threadId,
-				resourceId,
-				title,
-				metadata
-			}) });
-		} catch (error) {
-			return handleError(error, "Error creating conversation");
-		}
-	}
-});
-const GET_CONVERSATION_ROUTE = createRoute({
-	method: "GET",
-	path: "/v1/conversations/:conversationId",
-	responseType: "json",
-	pathParamSchema: conversationIdPathParams,
-	responseSchema: conversationObjectSchema,
-	summary: "Retrieve a conversation",
-	description: "Returns a conversation object backed by a Mastra memory thread",
-	tags: ["Responses"],
-	requiresAuth: true,
-	requiresPermission: MastraFGAPermissions.AGENTS_READ,
-	handler: async ({ mastra, requestContext, conversationId }) => {
-		try {
-			const match = await findConversationThreadAcrossAgents({
-				mastra,
-				conversationId,
-				requestContext
-			});
-			if (!match) throw new HTTPException(404, { message: `Conversation ${conversationId} was not found` });
-			return buildConversationObject({ thread: match.thread });
-		} catch (error) {
-			return handleError(error, "Error retrieving conversation");
-		}
-	}
-});
-const GET_CONVERSATION_ITEMS_ROUTE = createRoute({
-	method: "GET",
-	path: "/v1/conversations/:conversationId/items",
-	responseType: "json",
-	pathParamSchema: conversationIdPathParams,
-	responseSchema: conversationItemsListSchema,
-	summary: "List conversation items",
-	description: "Returns OpenAI-style conversation items derived from the stored thread messages",
-	tags: ["Responses"],
-	requiresAuth: true,
-	requiresPermission: MastraFGAPermissions.AGENTS_READ,
-	handler: async ({ mastra, requestContext, conversationId }) => {
-		try {
-			const match = await findConversationThreadAcrossAgents({
-				mastra,
-				conversationId,
-				requestContext
-			});
-			if (!match) throw new HTTPException(404, { message: `Conversation ${conversationId} was not found` });
-			const { messages } = await match.memoryStore.listMessages({
-				threadId: conversationId,
-				page: 0,
-				perPage: 1e3
-			});
-			return buildConversationItemsList(mapMastraMessagesToConversationItems(messages));
-		} catch (error) {
-			return handleError(error, "Error retrieving conversation");
-		}
-	}
-});
-const DELETE_CONVERSATION_ROUTE = createRoute({
-	method: "DELETE",
-	path: "/v1/conversations/:conversationId",
-	responseType: "json",
-	pathParamSchema: conversationIdPathParams,
-	responseSchema: conversationDeletedSchema,
-	summary: "Delete a conversation",
-	description: "Deletes a thread-backed conversation and its stored items",
-	tags: ["Responses"],
-	requiresAuth: true,
-	requiresPermission: MastraFGAPermissions.AGENTS_DELETE,
-	handler: async ({ mastra, requestContext, conversationId }) => {
-		try {
-			const match = await findConversationThreadAcrossAgents({
-				mastra,
-				conversationId,
-				requestContext
-			});
-			if (!match) throw new HTTPException(404, { message: `Conversation ${conversationId} was not found` });
-			await match.memoryStore.deleteThread({ threadId: conversationId });
-			return buildConversationDeleted(conversationId);
-		} catch (error) {
-			return handleError(error, "Error deleting conversation");
-		}
-	}
-});
-//#endregion
-export { CREATE_CONVERSATION_ROUTE, DELETE_CONVERSATION_ROUTE, GET_CONVERSATION_ITEMS_ROUTE, GET_CONVERSATION_ROUTE, conversations_exports as t };
-
-//# sourceMappingURL=conversations.js.map
+export { t as CREATE_CONVERSATION_ROUTE, n as DELETE_CONVERSATION_ROUTE, r as GET_CONVERSATION_ITEMS_ROUTE, i as GET_CONVERSATION_ROUTE } from "../../conversations-8BWryNlF.js";

package/dist/server/handlers/datasets.cjs

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-require("../../rolldown-runtime-Bd6kNlEP.cjs");
+require("../../rolldown-runtime-BwC_XMyb.cjs");
 const require_http_exception = require("../../http-exception-CKDHupKw.cjs");
 const require_common = require("../../common-DhKNoXGp.cjs");
-const require_route_builder = require("../../route-builder-BNZs643f.cjs");
+const require_route_builder = require("../../route-builder-B2Qhhd7C.cjs");
 const require_constants = require("../../constants-e7aaPCLj.cjs");
 const require_server_handlers_error = require("./error.cjs");
 const require_datasets = require("../../datasets-BUC5T-fd.cjs");