@mastra/server 1.80.0-alpha.3 → 1.80.0-alpha.5

package/dist/tools-CeVJwkPP.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools-CeVJwkPP.cjs","names":["standardSchemaToJSONSchema","toStandardSchema","stringify","stripInjectedToolOverrideFields","isProviderDefinedTool","createRoute","listToolsResponseSchema","getHandlerFGAProvider","MastraFGAPermissions","handleError","toolIdPathParams","serializedToolSchema","HTTPException","optionalRunIdSchema","executeToolContextBodySchema","executeToolResponseSchema","isVercelTool","agentToolPathParams","getAgentFromSystem","executeToolBodySchema"],"sources":["../src/server/handlers/tools.ts"],"sourcesContent":["import { isVercelTool, isProviderDefinedTool } from '@mastra/core/tools';\nimport { toStandardSchema, standardSchemaToJSONSchema } from '@mastra/schema-compat/schema';\nimport type { PublicSchema } from '@mastra/schema-compat/schema';\nimport { stringify } from 'superjson';\nimport { MastraFGAPermissions } from '../fga-permissions';\nimport { HTTPException } from '../http-exception';\nimport {\n  executeToolContextBodySchema,\n  executeToolResponseSchema,\n  listToolsResponseSchema,\n  serializedToolSchema,\n  toolIdPathParams,\n  agentToolPathParams,\n  executeToolBodySchema,\n} from '../schemas/agents';\nimport { optionalRunIdSchema } from '../schemas/common';\nimport { createRoute } from '../server-adapter/routes/route-builder';\n\nimport { getAgentFromSystem } from './agents';\nimport { handleError } from './error';\nimport { stripInjectedToolOverrideFields } from './tool-schema-overrides';\nimport { getHandlerFGAProvider, validateBody } from './utils';\n\n/**\n * Resolves a schema that may be a lazy function (e.g. AI SDK provider tools).\n * Recursively resolves until a non-function value is returned.\n * Skips functions that are themselves valid schemas (e.g. ArkType types are\n * callable but also implement StandardSchema via ~standard).\n */\nfunction resolveLazySchema(schema: unknown): unknown {\n  if (typeof schema === 'function' && !('~standard' in schema)) {\n    return resolveLazySchema(schema());\n  }\n  return schema;\n}\n\nfunction schemaToJsonSchema(schema: PublicSchema<unknown> | undefined) {\n  if (!schema) {\n    return undefined;\n  }\n\n  return standardSchemaToJSONSchema(toStandardSchema(schema), { target: 'draft-2020-12' });\n}\n\nfunction serializeSchema(schema: unknown, options?: { stripInjectedOverrides?: boolean }): string | undefined {\n  const jsonSchema = schemaToJsonSchema(resolveLazySchema(schema) as PublicSchema<unknown> | undefined);\n  if (jsonSchema === undefined) return undefined;\n  return stringify(options?.stripInjectedOverrides ? stripInjectedToolOverrideFields(jsonSchema) : jsonSchema);\n}\n\n/**\n * Searches dynamically-resolved agent tools (provided via `toolsResolver` /\n * function-based `tools`) for a tool with the given id. Used as a fallback\n * after the static tool registry (`registeredTools` + `mastra.getToolById`)\n * misses, so global tool routes can resolve tools that only exist on agents.\n *\n * Errors thrown by an individual agent's `listTools()` are logged and\n * skipped so a single broken resolver doesn't take down the whole lookup.\n */\nasync function findToolInAgents(mastra: any, toolId: string, requestContext: any): Promise<any | undefined> {\n  const agents = mastra.listAgents() || {};\n  for (const agent of Object.values(agents) as any[]) {\n    try {\n      const agentTools = await agent.listTools({ requestContext });\n      const found = Object.values(agentTools || {}).find((t: any) => t.id === toolId);\n      if (found) return found;\n    } catch (error) {\n      mastra.getLogger?.()?.warn?.('Failed to list tools for agent while resolving tool by id', {\n        agentId: agent?.id,\n        toolId,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  return undefined;\n}\n\n/**\n * Serializes a tool for API responses, handling both regular tools (with Zod schemas)\n * and provider-defined tools (with AI SDK lazy schemas).\n */\nfunction serializeTool(tool: any): any {\n  // Provider-defined tools (e.g. google.tools.googleSearch(), openai.tools.webSearch())\n  // have lazy inputSchema functions that return AI SDK Schema objects, not Zod schemas.\n  // We resolve them and use the jsonSchema property directly.\n  if (isProviderDefinedTool(tool)) {\n    const resolvedInput = resolveLazySchema(tool.inputSchema);\n    const resolvedOutput = resolveLazySchema(tool.outputSchema);\n    return {\n      ...tool,\n      inputSchema:\n        resolvedInput && typeof resolvedInput === 'object' && 'jsonSchema' in resolvedInput\n          ? stringify(resolvedInput.jsonSchema)\n          : undefined,\n      outputSchema:\n        resolvedOutput && typeof resolvedOutput === 'object' && 'jsonSchema' in resolvedOutput\n          ? stringify(resolvedOutput.jsonSchema)\n          : undefined,\n    };\n  }\n\n  return {\n    ...tool,\n    inputSchema: serializeSchema(tool.inputSchema, { stripInjectedOverrides: true }),\n    outputSchema: serializeSchema(tool.outputSchema),\n    requestContextSchema: serializeSchema(tool.requestContextSchema),\n  };\n}\n\n// ============================================================================\n// Route Definitions (new pattern - handlers defined inline with createRoute)\n// ============================================================================\n\nexport const LIST_TOOLS_ROUTE = createRoute({\n  method: 'GET',\n  path: '/tools',\n  responseType: 'json',\n  responseSchema: listToolsResponseSchema,\n  summary: 'List all tools',\n  description: 'Returns a list of all available tools in the system',\n  tags: ['Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, registeredTools, requestContext }) => {\n    try {\n      // Merge tools from two sources: mastra.listTools() includes dynamically created tools\n      // (e.g. MCP tools, or agent tools registered by their intrinsic id), while registeredTools\n      // includes tools discovered by the CLI bundler (keyed by export name).\n      //\n      // The same tool instance can appear in both maps under different keys (e.g. an agent\n      // registers it by `tool.id` while the bundler registers it by export name). Dedupe by\n      // `tool.id`, preferring the registeredTools (bundler) key, so each tool appears once.\n      const registered = registeredTools && Object.keys(registeredTools).length > 0 ? registeredTools : {};\n\n      const allTools: Record<string, any> = {};\n      const seenToolIds = new Map<string, string>();\n\n      // registeredTools first so their key wins for a given tool.id.\n      for (const [key, tool] of Object.entries(registered)) {\n        const toolId = typeof (tool as any)?.id === 'string' ? (tool as any).id : undefined;\n        if (toolId !== undefined) seenToolIds.set(toolId, key);\n        allTools[key] = tool;\n      }\n\n      for (const [key, tool] of Object.entries(mastra.listTools() ?? {})) {\n        const toolId = typeof (tool as any)?.id === 'string' ? (tool as any).id : undefined;\n        // Skip if this exact tool.id was already registered (under any key) by registeredTools.\n        if (toolId !== undefined && seenToolIds.has(toolId)) continue;\n        if (toolId !== undefined) seenToolIds.set(toolId, key);\n        allTools[key] = tool;\n      }\n\n      const serializedTools = Object.entries(allTools).reduce<Record<string, any>>((acc, [id, _tool]) => {\n        acc[id] = serializeTool(_tool);\n        return acc;\n      }, {});\n\n      // Filter tools by FGA if configured\n      const fgaProvider = getHandlerFGAProvider(mastra, requestContext);\n      const user = requestContext?.get('user');\n      if (fgaProvider && user) {\n        const toolList = Object.entries(serializedTools).map(([id, t]) => ({ id, ...t }));\n        const accessible = await fgaProvider.filterAccessible(user, toolList, 'tool', MastraFGAPermissions.TOOLS_READ);\n        const accessibleSet = new Set(accessible.map((t: any) => t.id));\n        for (const id of Object.keys(serializedTools)) {\n          if (!accessibleSet.has(id)) {\n            delete serializedTools[id];\n          }\n        }\n      }\n\n      return serializedTools;\n    } catch (error) {\n      return handleError(error, 'Error getting tools');\n    }\n  },\n});\n\nexport const GET_TOOL_BY_ID_ROUTE = createRoute({\n  method: 'GET',\n  path: '/tools/:toolId',\n  responseType: 'json',\n  pathParamSchema: toolIdPathParams,\n  responseSchema: serializedToolSchema,\n  summary: 'Get tool by ID',\n  description: 'Returns details for a specific tool including its schema and configuration',\n  tags: ['Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, registeredTools, toolId, requestContext }) => {\n    try {\n      let tool: any;\n\n      // Try explicit registeredTools first, then fallback to mastra\n      if (registeredTools && Object.keys(registeredTools).length > 0) {\n        tool = Object.values(registeredTools).find((t: any) => t.id === toolId);\n      }\n      if (!tool) {\n        try {\n          tool = mastra.getToolById(toolId);\n        } catch {\n          // tool not found in global registry, continue to agent fallback\n        }\n      }\n\n      // Fallback: search dynamically-resolved agent tools (toolsResolver)\n      if (!tool) {\n        tool = await findToolInAgents(mastra, toolId, requestContext);\n      }\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      return serializeTool(tool);\n    } catch (error) {\n      return handleError(error, 'Error getting tool');\n    }\n  },\n});\n\nexport const EXECUTE_TOOL_ROUTE = createRoute({\n  method: 'POST',\n  path: '/tools/:toolId/execute',\n  responseType: 'json',\n  pathParamSchema: toolIdPathParams,\n  queryParamSchema: optionalRunIdSchema,\n  bodySchema: executeToolContextBodySchema,\n  responseSchema: executeToolResponseSchema,\n  summary: 'Execute tool',\n  description: 'Executes a specific tool with the provided input data',\n  tags: ['Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, runId, toolId, registeredTools, requestContext, ...bodyParams }) => {\n    try {\n      if (!toolId) {\n        throw new HTTPException(400, { message: 'Tool ID is required' });\n      }\n\n      let tool: any;\n\n      // Try explicit registeredTools first, then fallback to mastra\n      if (registeredTools && Object.keys(registeredTools).length > 0) {\n        tool = Object.values(registeredTools).find((t: any) => t.id === toolId);\n      }\n      if (!tool) {\n        try {\n          tool = mastra.getToolById(toolId);\n        } catch {\n          // tool not found in global registry, continue to agent fallback\n        }\n      }\n\n      // Fallback: search dynamically-resolved agent tools (toolsResolver)\n      if (!tool) {\n        tool = await findToolInAgents(mastra, toolId, requestContext);\n      }\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      if (!tool?.execute) {\n        throw new HTTPException(400, { message: 'Tool is not executable' });\n      }\n\n      const { data } = bodyParams;\n\n      validateBody({ data });\n\n      let result;\n      if (isVercelTool(tool)) {\n        result = await (tool as any).execute(data);\n      } else {\n        result = await tool.execute(data!, {\n          mastra,\n          requestContext,\n          // TODO: Pass proper tracing context when server API supports tracing\n          tracingContext: { currentSpan: undefined },\n          ...(runId\n            ? {\n                workflow: {\n                  runId,\n                  suspend: async () => {},\n                },\n              }\n            : {}),\n        });\n      }\n\n      return result;\n    } catch (error) {\n      return handleError(error, 'Error executing tool');\n    }\n  },\n});\n\n// ============================================================================\n// Agent Tool Routes\n// ============================================================================\n\nexport const GET_AGENT_TOOL_ROUTE = createRoute({\n  method: 'GET',\n  path: '/agents/:agentId/tools/:toolId',\n  responseType: 'json',\n  pathParamSchema: agentToolPathParams,\n  responseSchema: serializedToolSchema,\n  summary: 'Get agent tool',\n  description: 'Returns details for a specific tool assigned to the agent',\n  tags: ['Agents', 'Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, agentId, toolId, requestContext }) => {\n    try {\n      if (!agentId) {\n        throw new HTTPException(400, { message: 'Agent ID is required' });\n      }\n      const agent = await getAgentFromSystem({ mastra, agentId });\n\n      const agentTools = await agent.listTools({ requestContext });\n\n      const tool = Object.values(agentTools || {}).find((tool: any) => tool.id === toolId) as any;\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      return serializeTool(tool);\n    } catch (error) {\n      return handleError(error, 'Error getting agent tool');\n    }\n  },\n});\n\nexport const EXECUTE_AGENT_TOOL_ROUTE = createRoute({\n  method: 'POST',\n  path: '/agents/:agentId/tools/:toolId/execute',\n  responseType: 'json',\n  pathParamSchema: agentToolPathParams,\n  bodySchema: executeToolBodySchema,\n  responseSchema: executeToolResponseSchema,\n  summary: 'Execute agent tool',\n  description: 'Executes a specific tool assigned to the agent with the provided input data',\n  tags: ['Agents', 'Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, agentId, toolId, data, requestContext }) => {\n    try {\n      if (!agentId) {\n        throw new HTTPException(400, { message: 'Agent ID is required' });\n      }\n      const agent = await getAgentFromSystem({ mastra, agentId });\n\n      const agentTools = await agent.listTools({ requestContext });\n\n      const tool = Object.values(agentTools || {}).find((tool: any) => tool.id === toolId) as any;\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      if (!tool?.execute) {\n        throw new HTTPException(400, { message: 'Tool is not executable' });\n      }\n\n      const result = await tool.execute(data, {\n        mastra,\n        requestContext,\n        // TODO: Pass proper tracing context when server API supports tracing\n        tracingContext: { currentSpan: undefined },\n      });\n\n      return result;\n    } catch (error) {\n      return handleError(error, 'Error executing agent tool');\n    }\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,kBAAkB,QAA0B;CACnD,IAAI,OAAO,WAAW,cAAc,EAAE,eAAe,SACnD,OAAO,kBAAkB,OAAO,CAAC;CAEnC,OAAO;AACT;AAEA,SAAS,mBAAmB,QAA2C;CACrE,IAAI,CAAC,QACH;CAGF,OAAOA,wBAAAA,2BAA2BC,wBAAAA,iBAAiB,MAAM,GAAG,EAAE,QAAQ,gBAAgB,CAAC;AACzF;AAEA,SAAS,gBAAgB,QAAiB,SAAoE;CAC5G,MAAM,aAAa,mBAAmB,kBAAkB,MAAM,CAAsC;CACpG,IAAI,eAAe,KAAA,GAAW,OAAO,KAAA;CACrC,OAAOC,cAAAA,UAAU,SAAS,yBAAyBC,8CAAAA,gCAAgC,UAAU,IAAI,UAAU;AAC7G;;;;;;;;;;AAWA,eAAe,iBAAiB,QAAa,QAAgB,gBAA+C;CAC1G,MAAM,SAAS,OAAO,WAAW,KAAK,CAAC;CACvC,KAAK,MAAM,SAAS,OAAO,OAAO,MAAM,GACtC,IAAI;EACF,MAAM,aAAa,MAAM,MAAM,UAAU,EAAE,eAAe,CAAC;EAC3D,MAAM,QAAQ,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,MAAW,EAAE,OAAO,MAAM;EAC9E,IAAI,OAAO,OAAO;CACpB,SAAS,OAAO;EACd,OAAO,YAAY,CAAC,EAAE,OAAO,6DAA6D;GACxF,SAAS,OAAO;GAChB;GACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAC9D,CAAC;CACH;AAGJ;;;;;AAMA,SAAS,cAAc,MAAgB;CAIrC,KAAA,GAAIC,mBAAAA,sBAAAA,CAAsB,IAAI,GAAG;EAC/B,MAAM,gBAAgB,kBAAkB,KAAK,WAAW;EACxD,MAAM,iBAAiB,kBAAkB,KAAK,YAAY;EAC1D,OAAO;GACL,GAAG;GACH,aACE,iBAAiB,OAAO,kBAAkB,YAAY,gBAAgB,gBAClEF,cAAAA,UAAU,cAAc,UAAU,IAClC,KAAA;GACN,cACE,kBAAkB,OAAO,mBAAmB,YAAY,gBAAgB,iBACpEA,cAAAA,UAAU,eAAe,UAAU,IACnC,KAAA;EACR;CACF;CAEA,OAAO;EACL,GAAG;EACH,aAAa,gBAAgB,KAAK,aAAa,EAAE,wBAAwB,KAAK,CAAC;EAC/E,cAAc,gBAAgB,KAAK,YAAY;EAC/C,sBAAsB,gBAAgB,KAAK,oBAAoB;CACjE;AACF;AAMA,MAAa,mBAAmBG,sBAAAA,YAAY;CAC1C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,gBAAgBC,eAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,OAAO;CACd,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,iBAAiB,qBAAqB;EAC9D,IAAI;GAQF,MAAM,aAAa,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,IAAI,kBAAkB,CAAC;GAEnG,MAAM,WAAgC,CAAC;GACvC,MAAM,8BAAc,IAAI,IAAoB;GAG5C,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,UAAU,GAAG;IACpD,MAAM,SAAS,OAAQ,MAAc,OAAO,WAAY,KAAa,KAAK,KAAA;IAC1E,IAAI,WAAW,KAAA,GAAW,YAAY,IAAI,QAAQ,GAAG;IACrD,SAAS,OAAO;GAClB;GAEA,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,OAAO,UAAU,KAAK,CAAC,CAAC,GAAG;IAClE,MAAM,SAAS,OAAQ,MAAc,OAAO,WAAY,KAAa,KAAK,KAAA;IAE1E,IAAI,WAAW,KAAA,KAAa,YAAY,IAAI,MAAM,GAAG;IACrD,IAAI,WAAW,KAAA,GAAW,YAAY,IAAI,QAAQ,GAAG;IACrD,SAAS,OAAO;GAClB;GAEA,MAAM,kBAAkB,OAAO,QAAQ,QAAQ,CAAC,CAAC,QAA6B,KAAK,CAAC,IAAI,WAAW;IACjG,IAAI,MAAM,cAAc,KAAK;IAC7B,OAAO;GACT,GAAG,CAAC,CAAC;GAGL,MAAM,cAAcC,gBAAAA,sBAAsB,QAAQ,cAAc;GAChE,MAAM,OAAO,gBAAgB,IAAI,MAAM;GACvC,IAAI,eAAe,MAAM;IACvB,MAAM,WAAW,OAAO,QAAQ,eAAe,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ;KAAE;KAAI,GAAG;IAAE,EAAE;IAChF,MAAM,aAAa,MAAM,YAAY,iBAAiB,MAAM,UAAU,QAAQC,gBAAAA,qBAAqB,UAAU;IAC7G,MAAM,gBAAgB,IAAI,IAAI,WAAW,KAAK,MAAW,EAAE,EAAE,CAAC;IAC9D,KAAK,MAAM,MAAM,OAAO,KAAK,eAAe,GAC1C,IAAI,CAAC,cAAc,IAAI,EAAE,GACvB,OAAO,gBAAgB;GAG7B;GAEA,OAAO;EACT,SAAS,OAAO;GACd,OAAOC,8BAAAA,YAAY,OAAO,qBAAqB;EACjD;CACF;AACF,CAAC;AAED,MAAa,uBAAuBJ,sBAAAA,YAAY;CAC9C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBK,eAAAA;CACjB,gBAAgBC,eAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,OAAO;CACd,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,iBAAiB,QAAQ,qBAAqB;EACtE,IAAI;GACF,IAAI;GAGJ,IAAI,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,GAC3D,OAAO,OAAO,OAAO,eAAe,CAAC,CAAC,MAAM,MAAW,EAAE,OAAO,MAAM;GAExE,IAAI,CAAC,MACH,IAAI;IACF,OAAO,OAAO,YAAY,MAAM;GAClC,QAAQ,CAER;GAIF,IAAI,CAAC,MACH,OAAO,MAAM,iBAAiB,QAAQ,QAAQ,cAAc;GAG9D,IAAI,CAAC,MACH,MAAM,IAAIC,uBAAAA,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,OAAO,cAAc,IAAI;EAC3B,SAAS,OAAO;GACd,OAAOH,8BAAAA,YAAY,OAAO,oBAAoB;EAChD;CACF;AACF,CAAC;AAED,MAAa,qBAAqBJ,sBAAAA,YAAY;CAC5C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBK,eAAAA;CACjB,kBAAkBG,eAAAA;CAClB,YAAYC,eAAAA;CACZ,gBAAgBC,eAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,OAAO;CACd,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,OAAO,QAAQ,iBAAiB,gBAAgB,GAAG,iBAAiB;EAC5F,IAAI;GACF,IAAI,CAAC,QACH,MAAM,IAAIH,uBAAAA,cAAc,KAAK,EAAE,SAAS,sBAAsB,CAAC;GAGjE,IAAI;GAGJ,IAAI,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,GAC3D,OAAO,OAAO,OAAO,eAAe,CAAC,CAAC,MAAM,MAAW,EAAE,OAAO,MAAM;GAExE,IAAI,CAAC,MACH,IAAI;IACF,OAAO,OAAO,YAAY,MAAM;GAClC,QAAQ,CAER;GAIF,IAAI,CAAC,MACH,OAAO,MAAM,iBAAiB,QAAQ,QAAQ,cAAc;GAG9D,IAAI,CAAC,MACH,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,IAAI,CAAC,MAAM,SACT,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,yBAAyB,CAAC;GAGpE,MAAM,EAAE,SAAS;GAEjB,gBAAA,aAAa,EAAE,KAAK,CAAC;GAErB,IAAI;GACJ,KAAA,GAAII,mBAAAA,aAAAA,CAAa,IAAI,GACnB,SAAS,MAAO,KAAa,QAAQ,IAAI;QAEzC,SAAS,MAAM,KAAK,QAAQ,MAAO;IACjC;IACA;IAEA,gBAAgB,EAAE,aAAa,KAAA,EAAU;IACzC,GAAI,QACA,EACE,UAAU;KACR;KACA,SAAS,YAAY,CAAC;IACxB,EACF,IACA,CAAC;GACP,CAAC;GAGH,OAAO;EACT,SAAS,OAAO;GACd,OAAOP,8BAAAA,YAAY,OAAO,sBAAsB;EAClD;CACF;AACF,CAAC;AAMD,MAAa,uBAAuBJ,sBAAAA,YAAY;CAC9C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBY,eAAAA;CACjB,gBAAgBN,eAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,OAAO;CACxB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,qBAAqB;EAC9D,IAAI;GACF,IAAI,CAAC,SACH,MAAM,IAAIC,uBAAAA,cAAc,KAAK,EAAE,SAAS,uBAAuB,CAAC;GAIlE,MAAM,aAAa,OAAM,MAFLM,iBAAAA,mBAAmB;IAAE;IAAQ;GAAQ,CAAC,EAAA,CAE3B,UAAU,EAAE,eAAe,CAAC;GAE3D,MAAM,OAAO,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,SAAc,KAAK,OAAO,MAAM;GAEnF,IAAI,CAAC,MACH,MAAM,IAAIN,uBAAAA,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,OAAO,cAAc,IAAI;EAC3B,SAAS,OAAO;GACd,OAAOH,8BAAAA,YAAY,OAAO,0BAA0B;EACtD;CACF;AACF,CAAC;AAED,MAAa,2BAA2BJ,sBAAAA,YAAY;CAClD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBY,eAAAA;CACjB,YAAYE,eAAAA;CACZ,gBAAgBJ,eAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,OAAO;CACxB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,MAAM,qBAAqB;EACpE,IAAI;GACF,IAAI,CAAC,SACH,MAAM,IAAIH,uBAAAA,cAAc,KAAK,EAAE,SAAS,uBAAuB,CAAC;GAIlE,MAAM,aAAa,OAAM,MAFLM,iBAAAA,mBAAmB;IAAE;IAAQ;GAAQ,CAAC,EAAA,CAE3B,UAAU,EAAE,eAAe,CAAC;GAE3D,MAAM,OAAO,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,SAAc,KAAK,OAAO,MAAM;GAEnF,IAAI,CAAC,MACH,MAAM,IAAIN,uBAAAA,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,IAAI,CAAC,MAAM,SACT,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,yBAAyB,CAAC;GAUpE,OAAO,MAPc,KAAK,QAAQ,MAAM;IACtC;IACA;IAEA,gBAAgB,EAAE,aAAa,KAAA,EAAU;GAC3C,CAAC;EAGH,SAAS,OAAO;GACd,OAAOH,8BAAAA,YAAY,OAAO,4BAA4B;EACxD;CACF;AACF,CAAC"}

package/dist/{tools--oMljfqq.js → tools-hd_ZCJkE.js}

@@ -1,16 +1,16 @@
-import { r as __exportAll } from "./rolldown-runtime-D3Hj5m0v.js";
-import { t as HTTPException } from "./http-exception-CyfxZB6W.js";
-import { o as optionalRunIdSchema } from "./common-Y30XtCyr.js";
-import { D as listToolsResponseSchema, J as serializedToolSchema, S as executeToolResponseSchema, b as executeToolBodySchema, et as toolIdPathParams, u as agentToolPathParams, x as executeToolContextBodySchema } from "./agents-D1-fgNeb.js";
-import { n as standardSchemaToJSONSchema, r as toStandardSchema } from "./schema-CzbEIyhE-BsMcj9Ws.js";
-import { n as createRoute } from "./route-builder-CjkWxv4E.js";
-import { l as stringify } from "./utils-aoLN3Wfi.js";
+import { r as __exportAll } from "./rolldown-runtime-CQI-hT2b.js";
+import { t as HTTPException } from "./http-exception-CzaWkxMl.js";
+import { o as optionalRunIdSchema } from "./common-xUmaFUop.js";
+import { D as listToolsResponseSchema, J as serializedToolSchema, S as executeToolResponseSchema, b as executeToolBodySchema, et as toolIdPathParams, u as agentToolPathParams, x as executeToolContextBodySchema } from "./agents-A-ahR0eQ.js";
+import { n as standardSchemaToJSONSchema, r as toStandardSchema } from "./schema-Bf12g7KC-DBc4NSds.js";
+import { n as createRoute } from "./route-builder-BxPrwNog.js";
+import { l as stringify } from "./utils-YEuwVEc2.js";
 import { handleError } from "./server/handlers/error.js";
-import { g as MastraFGAPermissions, p as validateBody } from "./utils-BBJlS81s.js";
+import { _ as MastraFGAPermissions, m as validateBody, o as getHandlerFGAProvider } from "./utils-DHxjw4Tn.js";
 import { stripInjectedToolOverrideFields } from "./server/handlers/tool-schema-overrides.js";
-import { G as getAgentFromSystem } from "./agents-BYE5Dmfk.js";
+import { G as getAgentFromSystem } from "./agents-CGS0tE4p.js";
 import { isProviderDefinedTool, isVercelTool } from "@mastra/core/tools";
-//#region src/server/handlers/tools.ts
+// src/server/handlers/tools.ts
 var tools_exports = /* @__PURE__ */ __exportAll({
 	EXECUTE_AGENT_TOOL_ROUTE: () => EXECUTE_AGENT_TOOL_ROUTE,
 	EXECUTE_TOOL_ROUTE: () => EXECUTE_TOOL_ROUTE,
@@ -110,7 +110,7 @@ const LIST_TOOLS_ROUTE = createRoute({
 				acc[id] = serializeTool(_tool);
 				return acc;
 			}, {});
-			const fgaProvider = mastra.getServer?.()?.fga;
+			const fgaProvider = getHandlerFGAProvider(mastra, requestContext);
 			const user = requestContext?.get("user");
 			if (fgaProvider && user) {
 				const toolList = Object.entries(serializedTools).map(([id, t]) => ({
@@ -250,7 +250,6 @@ const EXECUTE_AGENT_TOOL_ROUTE = createRoute({
 		}
 	}
 });
-//#endregion
 export { LIST_TOOLS_ROUTE as a, GET_TOOL_BY_ID_ROUTE as i, EXECUTE_TOOL_ROUTE as n, tools_exports as o, GET_AGENT_TOOL_ROUTE as r, EXECUTE_AGENT_TOOL_ROUTE as t };
 
-//# sourceMappingURL=tools--oMljfqq.js.map
+//# sourceMappingURL=tools-hd_ZCJkE.js.map

package/dist/tools-hd_ZCJkE.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools-hd_ZCJkE.js","names":[],"sources":["../src/server/handlers/tools.ts"],"sourcesContent":["import { isVercelTool, isProviderDefinedTool } from '@mastra/core/tools';\nimport { toStandardSchema, standardSchemaToJSONSchema } from '@mastra/schema-compat/schema';\nimport type { PublicSchema } from '@mastra/schema-compat/schema';\nimport { stringify } from 'superjson';\nimport { MastraFGAPermissions } from '../fga-permissions';\nimport { HTTPException } from '../http-exception';\nimport {\n  executeToolContextBodySchema,\n  executeToolResponseSchema,\n  listToolsResponseSchema,\n  serializedToolSchema,\n  toolIdPathParams,\n  agentToolPathParams,\n  executeToolBodySchema,\n} from '../schemas/agents';\nimport { optionalRunIdSchema } from '../schemas/common';\nimport { createRoute } from '../server-adapter/routes/route-builder';\n\nimport { getAgentFromSystem } from './agents';\nimport { handleError } from './error';\nimport { stripInjectedToolOverrideFields } from './tool-schema-overrides';\nimport { getHandlerFGAProvider, validateBody } from './utils';\n\n/**\n * Resolves a schema that may be a lazy function (e.g. AI SDK provider tools).\n * Recursively resolves until a non-function value is returned.\n * Skips functions that are themselves valid schemas (e.g. ArkType types are\n * callable but also implement StandardSchema via ~standard).\n */\nfunction resolveLazySchema(schema: unknown): unknown {\n  if (typeof schema === 'function' && !('~standard' in schema)) {\n    return resolveLazySchema(schema());\n  }\n  return schema;\n}\n\nfunction schemaToJsonSchema(schema: PublicSchema<unknown> | undefined) {\n  if (!schema) {\n    return undefined;\n  }\n\n  return standardSchemaToJSONSchema(toStandardSchema(schema), { target: 'draft-2020-12' });\n}\n\nfunction serializeSchema(schema: unknown, options?: { stripInjectedOverrides?: boolean }): string | undefined {\n  const jsonSchema = schemaToJsonSchema(resolveLazySchema(schema) as PublicSchema<unknown> | undefined);\n  if (jsonSchema === undefined) return undefined;\n  return stringify(options?.stripInjectedOverrides ? stripInjectedToolOverrideFields(jsonSchema) : jsonSchema);\n}\n\n/**\n * Searches dynamically-resolved agent tools (provided via `toolsResolver` /\n * function-based `tools`) for a tool with the given id. Used as a fallback\n * after the static tool registry (`registeredTools` + `mastra.getToolById`)\n * misses, so global tool routes can resolve tools that only exist on agents.\n *\n * Errors thrown by an individual agent's `listTools()` are logged and\n * skipped so a single broken resolver doesn't take down the whole lookup.\n */\nasync function findToolInAgents(mastra: any, toolId: string, requestContext: any): Promise<any | undefined> {\n  const agents = mastra.listAgents() || {};\n  for (const agent of Object.values(agents) as any[]) {\n    try {\n      const agentTools = await agent.listTools({ requestContext });\n      const found = Object.values(agentTools || {}).find((t: any) => t.id === toolId);\n      if (found) return found;\n    } catch (error) {\n      mastra.getLogger?.()?.warn?.('Failed to list tools for agent while resolving tool by id', {\n        agentId: agent?.id,\n        toolId,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  return undefined;\n}\n\n/**\n * Serializes a tool for API responses, handling both regular tools (with Zod schemas)\n * and provider-defined tools (with AI SDK lazy schemas).\n */\nfunction serializeTool(tool: any): any {\n  // Provider-defined tools (e.g. google.tools.googleSearch(), openai.tools.webSearch())\n  // have lazy inputSchema functions that return AI SDK Schema objects, not Zod schemas.\n  // We resolve them and use the jsonSchema property directly.\n  if (isProviderDefinedTool(tool)) {\n    const resolvedInput = resolveLazySchema(tool.inputSchema);\n    const resolvedOutput = resolveLazySchema(tool.outputSchema);\n    return {\n      ...tool,\n      inputSchema:\n        resolvedInput && typeof resolvedInput === 'object' && 'jsonSchema' in resolvedInput\n          ? stringify(resolvedInput.jsonSchema)\n          : undefined,\n      outputSchema:\n        resolvedOutput && typeof resolvedOutput === 'object' && 'jsonSchema' in resolvedOutput\n          ? stringify(resolvedOutput.jsonSchema)\n          : undefined,\n    };\n  }\n\n  return {\n    ...tool,\n    inputSchema: serializeSchema(tool.inputSchema, { stripInjectedOverrides: true }),\n    outputSchema: serializeSchema(tool.outputSchema),\n    requestContextSchema: serializeSchema(tool.requestContextSchema),\n  };\n}\n\n// ============================================================================\n// Route Definitions (new pattern - handlers defined inline with createRoute)\n// ============================================================================\n\nexport const LIST_TOOLS_ROUTE = createRoute({\n  method: 'GET',\n  path: '/tools',\n  responseType: 'json',\n  responseSchema: listToolsResponseSchema,\n  summary: 'List all tools',\n  description: 'Returns a list of all available tools in the system',\n  tags: ['Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, registeredTools, requestContext }) => {\n    try {\n      // Merge tools from two sources: mastra.listTools() includes dynamically created tools\n      // (e.g. MCP tools, or agent tools registered by their intrinsic id), while registeredTools\n      // includes tools discovered by the CLI bundler (keyed by export name).\n      //\n      // The same tool instance can appear in both maps under different keys (e.g. an agent\n      // registers it by `tool.id` while the bundler registers it by export name). Dedupe by\n      // `tool.id`, preferring the registeredTools (bundler) key, so each tool appears once.\n      const registered = registeredTools && Object.keys(registeredTools).length > 0 ? registeredTools : {};\n\n      const allTools: Record<string, any> = {};\n      const seenToolIds = new Map<string, string>();\n\n      // registeredTools first so their key wins for a given tool.id.\n      for (const [key, tool] of Object.entries(registered)) {\n        const toolId = typeof (tool as any)?.id === 'string' ? (tool as any).id : undefined;\n        if (toolId !== undefined) seenToolIds.set(toolId, key);\n        allTools[key] = tool;\n      }\n\n      for (const [key, tool] of Object.entries(mastra.listTools() ?? {})) {\n        const toolId = typeof (tool as any)?.id === 'string' ? (tool as any).id : undefined;\n        // Skip if this exact tool.id was already registered (under any key) by registeredTools.\n        if (toolId !== undefined && seenToolIds.has(toolId)) continue;\n        if (toolId !== undefined) seenToolIds.set(toolId, key);\n        allTools[key] = tool;\n      }\n\n      const serializedTools = Object.entries(allTools).reduce<Record<string, any>>((acc, [id, _tool]) => {\n        acc[id] = serializeTool(_tool);\n        return acc;\n      }, {});\n\n      // Filter tools by FGA if configured\n      const fgaProvider = getHandlerFGAProvider(mastra, requestContext);\n      const user = requestContext?.get('user');\n      if (fgaProvider && user) {\n        const toolList = Object.entries(serializedTools).map(([id, t]) => ({ id, ...t }));\n        const accessible = await fgaProvider.filterAccessible(user, toolList, 'tool', MastraFGAPermissions.TOOLS_READ);\n        const accessibleSet = new Set(accessible.map((t: any) => t.id));\n        for (const id of Object.keys(serializedTools)) {\n          if (!accessibleSet.has(id)) {\n            delete serializedTools[id];\n          }\n        }\n      }\n\n      return serializedTools;\n    } catch (error) {\n      return handleError(error, 'Error getting tools');\n    }\n  },\n});\n\nexport const GET_TOOL_BY_ID_ROUTE = createRoute({\n  method: 'GET',\n  path: '/tools/:toolId',\n  responseType: 'json',\n  pathParamSchema: toolIdPathParams,\n  responseSchema: serializedToolSchema,\n  summary: 'Get tool by ID',\n  description: 'Returns details for a specific tool including its schema and configuration',\n  tags: ['Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, registeredTools, toolId, requestContext }) => {\n    try {\n      let tool: any;\n\n      // Try explicit registeredTools first, then fallback to mastra\n      if (registeredTools && Object.keys(registeredTools).length > 0) {\n        tool = Object.values(registeredTools).find((t: any) => t.id === toolId);\n      }\n      if (!tool) {\n        try {\n          tool = mastra.getToolById(toolId);\n        } catch {\n          // tool not found in global registry, continue to agent fallback\n        }\n      }\n\n      // Fallback: search dynamically-resolved agent tools (toolsResolver)\n      if (!tool) {\n        tool = await findToolInAgents(mastra, toolId, requestContext);\n      }\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      return serializeTool(tool);\n    } catch (error) {\n      return handleError(error, 'Error getting tool');\n    }\n  },\n});\n\nexport const EXECUTE_TOOL_ROUTE = createRoute({\n  method: 'POST',\n  path: '/tools/:toolId/execute',\n  responseType: 'json',\n  pathParamSchema: toolIdPathParams,\n  queryParamSchema: optionalRunIdSchema,\n  bodySchema: executeToolContextBodySchema,\n  responseSchema: executeToolResponseSchema,\n  summary: 'Execute tool',\n  description: 'Executes a specific tool with the provided input data',\n  tags: ['Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, runId, toolId, registeredTools, requestContext, ...bodyParams }) => {\n    try {\n      if (!toolId) {\n        throw new HTTPException(400, { message: 'Tool ID is required' });\n      }\n\n      let tool: any;\n\n      // Try explicit registeredTools first, then fallback to mastra\n      if (registeredTools && Object.keys(registeredTools).length > 0) {\n        tool = Object.values(registeredTools).find((t: any) => t.id === toolId);\n      }\n      if (!tool) {\n        try {\n          tool = mastra.getToolById(toolId);\n        } catch {\n          // tool not found in global registry, continue to agent fallback\n        }\n      }\n\n      // Fallback: search dynamically-resolved agent tools (toolsResolver)\n      if (!tool) {\n        tool = await findToolInAgents(mastra, toolId, requestContext);\n      }\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      if (!tool?.execute) {\n        throw new HTTPException(400, { message: 'Tool is not executable' });\n      }\n\n      const { data } = bodyParams;\n\n      validateBody({ data });\n\n      let result;\n      if (isVercelTool(tool)) {\n        result = await (tool as any).execute(data);\n      } else {\n        result = await tool.execute(data!, {\n          mastra,\n          requestContext,\n          // TODO: Pass proper tracing context when server API supports tracing\n          tracingContext: { currentSpan: undefined },\n          ...(runId\n            ? {\n                workflow: {\n                  runId,\n                  suspend: async () => {},\n                },\n              }\n            : {}),\n        });\n      }\n\n      return result;\n    } catch (error) {\n      return handleError(error, 'Error executing tool');\n    }\n  },\n});\n\n// ============================================================================\n// Agent Tool Routes\n// ============================================================================\n\nexport const GET_AGENT_TOOL_ROUTE = createRoute({\n  method: 'GET',\n  path: '/agents/:agentId/tools/:toolId',\n  responseType: 'json',\n  pathParamSchema: agentToolPathParams,\n  responseSchema: serializedToolSchema,\n  summary: 'Get agent tool',\n  description: 'Returns details for a specific tool assigned to the agent',\n  tags: ['Agents', 'Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, agentId, toolId, requestContext }) => {\n    try {\n      if (!agentId) {\n        throw new HTTPException(400, { message: 'Agent ID is required' });\n      }\n      const agent = await getAgentFromSystem({ mastra, agentId });\n\n      const agentTools = await agent.listTools({ requestContext });\n\n      const tool = Object.values(agentTools || {}).find((tool: any) => tool.id === toolId) as any;\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      return serializeTool(tool);\n    } catch (error) {\n      return handleError(error, 'Error getting agent tool');\n    }\n  },\n});\n\nexport const EXECUTE_AGENT_TOOL_ROUTE = createRoute({\n  method: 'POST',\n  path: '/agents/:agentId/tools/:toolId/execute',\n  responseType: 'json',\n  pathParamSchema: agentToolPathParams,\n  bodySchema: executeToolBodySchema,\n  responseSchema: executeToolResponseSchema,\n  summary: 'Execute agent tool',\n  description: 'Executes a specific tool assigned to the agent with the provided input data',\n  tags: ['Agents', 'Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, agentId, toolId, data, requestContext }) => {\n    try {\n      if (!agentId) {\n        throw new HTTPException(400, { message: 'Agent ID is required' });\n      }\n      const agent = await getAgentFromSystem({ mastra, agentId });\n\n      const agentTools = await agent.listTools({ requestContext });\n\n      const tool = Object.values(agentTools || {}).find((tool: any) => tool.id === toolId) as any;\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      if (!tool?.execute) {\n        throw new HTTPException(400, { message: 'Tool is not executable' });\n      }\n\n      const result = await tool.execute(data, {\n        mastra,\n        requestContext,\n        // TODO: Pass proper tracing context when server API supports tracing\n        tracingContext: { currentSpan: undefined },\n      });\n\n      return result;\n    } catch (error) {\n      return handleError(error, 'Error executing agent tool');\n    }\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,kBAAkB,QAA0B;CACnD,IAAI,OAAO,WAAW,cAAc,EAAE,eAAe,SACnD,OAAO,kBAAkB,OAAO,CAAC;CAEnC,OAAO;AACT;AAEA,SAAS,mBAAmB,QAA2C;CACrE,IAAI,CAAC,QACH;CAGF,OAAO,2BAA2B,iBAAiB,MAAM,GAAG,EAAE,QAAQ,gBAAgB,CAAC;AACzF;AAEA,SAAS,gBAAgB,QAAiB,SAAoE;CAC5G,MAAM,aAAa,mBAAmB,kBAAkB,MAAM,CAAsC;CACpG,IAAI,eAAe,KAAA,GAAW,OAAO,KAAA;CACrC,OAAO,UAAU,SAAS,yBAAyB,gCAAgC,UAAU,IAAI,UAAU;AAC7G;;;;;;;;;;AAWA,eAAe,iBAAiB,QAAa,QAAgB,gBAA+C;CAC1G,MAAM,SAAS,OAAO,WAAW,KAAK,CAAC;CACvC,KAAK,MAAM,SAAS,OAAO,OAAO,MAAM,GACtC,IAAI;EACF,MAAM,aAAa,MAAM,MAAM,UAAU,EAAE,eAAe,CAAC;EAC3D,MAAM,QAAQ,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,MAAW,EAAE,OAAO,MAAM;EAC9E,IAAI,OAAO,OAAO;CACpB,SAAS,OAAO;EACd,OAAO,YAAY,CAAC,EAAE,OAAO,6DAA6D;GACxF,SAAS,OAAO;GAChB;GACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAC9D,CAAC;CACH;AAGJ;;;;;AAMA,SAAS,cAAc,MAAgB;CAIrC,IAAI,sBAAsB,IAAI,GAAG;EAC/B,MAAM,gBAAgB,kBAAkB,KAAK,WAAW;EACxD,MAAM,iBAAiB,kBAAkB,KAAK,YAAY;EAC1D,OAAO;GACL,GAAG;GACH,aACE,iBAAiB,OAAO,kBAAkB,YAAY,gBAAgB,gBAClE,UAAU,cAAc,UAAU,IAClC,KAAA;GACN,cACE,kBAAkB,OAAO,mBAAmB,YAAY,gBAAgB,iBACpE,UAAU,eAAe,UAAU,IACnC,KAAA;EACR;CACF;CAEA,OAAO;EACL,GAAG;EACH,aAAa,gBAAgB,KAAK,aAAa,EAAE,wBAAwB,KAAK,CAAC;EAC/E,cAAc,gBAAgB,KAAK,YAAY;EAC/C,sBAAsB,gBAAgB,KAAK,oBAAoB;CACjE;AACF;AAMA,MAAa,mBAAmB,YAAY;CAC1C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,OAAO;CACd,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,iBAAiB,qBAAqB;EAC9D,IAAI;GAQF,MAAM,aAAa,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,IAAI,kBAAkB,CAAC;GAEnG,MAAM,WAAgC,CAAC;GACvC,MAAM,8BAAc,IAAI,IAAoB;GAG5C,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,UAAU,GAAG;IACpD,MAAM,SAAS,OAAQ,MAAc,OAAO,WAAY,KAAa,KAAK,KAAA;IAC1E,IAAI,WAAW,KAAA,GAAW,YAAY,IAAI,QAAQ,GAAG;IACrD,SAAS,OAAO;GAClB;GAEA,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,OAAO,UAAU,KAAK,CAAC,CAAC,GAAG;IAClE,MAAM,SAAS,OAAQ,MAAc,OAAO,WAAY,KAAa,KAAK,KAAA;IAE1E,IAAI,WAAW,KAAA,KAAa,YAAY,IAAI,MAAM,GAAG;IACrD,IAAI,WAAW,KAAA,GAAW,YAAY,IAAI,QAAQ,GAAG;IACrD,SAAS,OAAO;GAClB;GAEA,MAAM,kBAAkB,OAAO,QAAQ,QAAQ,CAAC,CAAC,QAA6B,KAAK,CAAC,IAAI,WAAW;IACjG,IAAI,MAAM,cAAc,KAAK;IAC7B,OAAO;GACT,GAAG,CAAC,CAAC;GAGL,MAAM,cAAc,sBAAsB,QAAQ,cAAc;GAChE,MAAM,OAAO,gBAAgB,IAAI,MAAM;GACvC,IAAI,eAAe,MAAM;IACvB,MAAM,WAAW,OAAO,QAAQ,eAAe,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ;KAAE;KAAI,GAAG;IAAE,EAAE;IAChF,MAAM,aAAa,MAAM,YAAY,iBAAiB,MAAM,UAAU,QAAQ,qBAAqB,UAAU;IAC7G,MAAM,gBAAgB,IAAI,IAAI,WAAW,KAAK,MAAW,EAAE,EAAE,CAAC;IAC9D,KAAK,MAAM,MAAM,OAAO,KAAK,eAAe,GAC1C,IAAI,CAAC,cAAc,IAAI,EAAE,GACvB,OAAO,gBAAgB;GAG7B;GAEA,OAAO;EACT,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,qBAAqB;EACjD;CACF;AACF,CAAC;AAED,MAAa,uBAAuB,YAAY;CAC9C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,OAAO;CACd,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,iBAAiB,QAAQ,qBAAqB;EACtE,IAAI;GACF,IAAI;GAGJ,IAAI,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,GAC3D,OAAO,OAAO,OAAO,eAAe,CAAC,CAAC,MAAM,MAAW,EAAE,OAAO,MAAM;GAExE,IAAI,CAAC,MACH,IAAI;IACF,OAAO,OAAO,YAAY,MAAM;GAClC,QAAQ,CAER;GAIF,IAAI,CAAC,MACH,OAAO,MAAM,iBAAiB,QAAQ,QAAQ,cAAc;GAG9D,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,OAAO,cAAc,IAAI;EAC3B,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,oBAAoB;EAChD;CACF;AACF,CAAC;AAED,MAAa,qBAAqB,YAAY;CAC5C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,YAAY;CACZ,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,OAAO;CACd,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,OAAO,QAAQ,iBAAiB,gBAAgB,GAAG,iBAAiB;EAC5F,IAAI;GACF,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,sBAAsB,CAAC;GAGjE,IAAI;GAGJ,IAAI,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,GAC3D,OAAO,OAAO,OAAO,eAAe,CAAC,CAAC,MAAM,MAAW,EAAE,OAAO,MAAM;GAExE,IAAI,CAAC,MACH,IAAI;IACF,OAAO,OAAO,YAAY,MAAM;GAClC,QAAQ,CAER;GAIF,IAAI,CAAC,MACH,OAAO,MAAM,iBAAiB,QAAQ,QAAQ,cAAc;GAG9D,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,IAAI,CAAC,MAAM,SACT,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,yBAAyB,CAAC;GAGpE,MAAM,EAAE,SAAS;GAEjB,aAAa,EAAE,KAAK,CAAC;GAErB,IAAI;GACJ,IAAI,aAAa,IAAI,GACnB,SAAS,MAAO,KAAa,QAAQ,IAAI;QAEzC,SAAS,MAAM,KAAK,QAAQ,MAAO;IACjC;IACA;IAEA,gBAAgB,EAAE,aAAa,KAAA,EAAU;IACzC,GAAI,QACA,EACE,UAAU;KACR;KACA,SAAS,YAAY,CAAC;IACxB,EACF,IACA,CAAC;GACP,CAAC;GAGH,OAAO;EACT,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,sBAAsB;EAClD;CACF;AACF,CAAC;AAMD,MAAa,uBAAuB,YAAY;CAC9C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,OAAO;CACxB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,qBAAqB;EAC9D,IAAI;GACF,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,uBAAuB,CAAC;GAIlE,MAAM,aAAa,OAAM,MAFL,mBAAmB;IAAE;IAAQ;GAAQ,CAAC,EAAA,CAE3B,UAAU,EAAE,eAAe,CAAC;GAE3D,MAAM,OAAO,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,SAAc,KAAK,OAAO,MAAM;GAEnF,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,OAAO,cAAc,IAAI;EAC3B,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,0BAA0B;EACtD;CACF;AACF,CAAC;AAED,MAAa,2BAA2B,YAAY;CAClD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,YAAY;CACZ,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,OAAO;CACxB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,MAAM,qBAAqB;EACpE,IAAI;GACF,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,uBAAuB,CAAC;GAIlE,MAAM,aAAa,OAAM,MAFL,mBAAmB;IAAE;IAAQ;GAAQ,CAAC,EAAA,CAE3B,UAAU,EAAE,eAAe,CAAC;GAE3D,MAAM,OAAO,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,SAAc,KAAK,OAAO,MAAM;GAEnF,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,IAAI,CAAC,MAAM,SACT,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,yBAAyB,CAAC;GAUpE,OAAO,MAPc,KAAK,QAAQ,MAAM;IACtC;IACA;IAEA,gBAAgB,EAAE,aAAa,KAAA,EAAU;GAC3C,CAAC;EAGH,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,4BAA4B;EACxD;CACF;AACF,CAAC"}

package/dist/{utils-dDLIDg8O.cjs → utils-BbYUI6Yn.cjs}

@@ -1,10 +1,10 @@
-const require_rolldown_runtime = require("./rolldown-runtime-BwC_XMyb.cjs");
-const require_http_exception = require("./http-exception-CKDHupKw.cjs");
-const require_constants = require("./constants-e7aaPCLj.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-10nMEhjP.cjs");
+const require_http_exception = require("./http-exception-Co3MbFUf.cjs");
+const require_constants = require("./constants-Co1XjPjd.cjs");
 let _mastra_core_auth_ee = require("@mastra/core/auth/ee");
 _mastra_core_auth_ee = require_rolldown_runtime.__toESM(_mastra_core_auth_ee, 1);
 let _mastra_core_memory = require("@mastra/core/memory");
-//#region src/server/fga-permissions.ts
+// src/server/fga-permissions.ts
 /**
 * Safe re-export of `MastraFGAPermissions` from `@mastra/core/auth/ee`.
 *
@@ -51,8 +51,7 @@ const FALLBACK_PERMISSIONS = {
 };
 const realPermissions = _mastra_core_auth_ee.MastraFGAPermissions;
 const MastraFGAPermissions = realPermissions && Object.keys(realPermissions).length > 0 ? realPermissions : FALLBACK_PERMISSIONS;
-//#endregion
-//#region src/server/handlers/utils.ts
+// src/server/handlers/utils.ts
 /**
 * Resolves a workflow by id or registration key from the set Mastra exposes
 * publicly. Unlike `mastra.getWorkflowById`, this excludes hidden internal
@@ -63,6 +62,24 @@ function getPublicWorkflowById(mastra, workflowId) {
 	const workflows = mastra.listWorkflows();
 	return Object.values(workflows).find((workflow) => workflow.id === workflowId) ?? (Object.hasOwn(workflows, workflowId) ? workflows[workflowId] : void 0);
 }
+/**
+* Resolves the FGA provider a handler should use for this request, following
+* the same auth-mode-aware selection as the route-level checks: Studio auth
+* requests use `studio.fga` when it is configured, and everything else uses
+* `server.fga`.
+*
+* Returns `undefined` when FGA is not configured at all. When FGA is
+* configured but no provider applies to this request (for example `studio.fga`
+* is set and the request used server auth), the request is denied rather than
+* treated as unrestricted.
+*/
+function getHandlerFGAProvider(mastra, requestContext) {
+	const studioFga = mastra?.getStudio?.()?.fga;
+	const serverFga = mastra?.getServer?.()?.fga;
+	if (requestContext?.get("mastra__authMode") === "studio" && studioFga) return studioFga;
+	if (serverFga) return serverFga;
+	if (studioFga) throw new require_http_exception.HTTPException(403, { message: "Access denied: no FGA provider is configured for this request" });
+}
 function validateBody(body) {
 	const errorResponse = Object.entries(body).reduce((acc, [key, value]) => {
 		if (!value) acc[key] = `Argument "${key}" is required`;
@@ -194,7 +211,8 @@ async function validateThreadOwnership(thread, effectiveResourceId) {
 */
 async function enforceThreadAccess({ mastra, requestContext, threadId, thread, effectiveResourceId, permission = MastraFGAPermissions.MEMORY_READ }) {
 	await validateThreadOwnership(thread, effectiveResourceId);
-	if (!mastra?.getServer?.()?.fga) return;
+	const fgaProvider = getHandlerFGAProvider(mastra, requestContext);
+	if (!fgaProvider) return;
 	const user = requestContext?.get("user");
 	if (!user || typeof user !== "object") throw new require_http_exception.HTTPException(403, { message: "FGA authorization denied: authenticated user is required" });
 	await _mastra_core_memory.MastraMemory.checkThreadFGA({
@@ -203,7 +221,8 @@ async function enforceThreadAccess({ mastra, requestContext, threadId, thread, e
 		threadId,
 		resourceId: thread?.resourceId ?? effectiveResourceId,
 		requestContext,
-		permission
+		permission,
+		fgaProvider
 	});
 }
 /**
@@ -216,10 +235,9 @@ async function enforceThreadAccess({ mastra, requestContext, threadId, thread, e
 * an FGA provider authorizes the route; otherwise it is refused rather than granted implicitly,
 * as on the thread-transfer route.
 */
-async function validateRunOwnership(run, effectiveResourceId, mastra) {
+async function validateRunOwnership(run, effectiveResourceId, mastra, requestContext) {
 	if (!run) return;
-	const server = mastra?.getServer?.();
-	if (!(typeof (server?.auth)?.mapUserToResourceId === "function")) {
+	if (!(typeof ((mastra?.getServer?.())?.auth)?.mapUserToResourceId === "function")) {
 		if (effectiveResourceId && run.resourceId && run.resourceId !== effectiveResourceId) throw new require_http_exception.HTTPException(403, { message: "Access denied: workflow run belongs to a different resource" });
 		return;
 	}
@@ -227,9 +245,8 @@ async function validateRunOwnership(run, effectiveResourceId, mastra) {
 		if (run.resourceId !== effectiveResourceId) throw new require_http_exception.HTTPException(403, { message: "Access denied: workflow run belongs to a different resource" });
 		return;
 	}
-	if (!server?.fga) throw new require_http_exception.HTTPException(403, { message: "Access denied: unscoped workflow run access requires explicit authorization. Configure an FGA provider to authorize privileged run access." });
+	if (!getHandlerFGAProvider(mastra, requestContext)) throw new require_http_exception.HTTPException(403, { message: "Access denied: unscoped workflow run access requires explicit authorization. Configure an FGA provider to authorize privileged run access." });
 }
-//#endregion
 Object.defineProperty(exports, "MastraFGAPermissions", {
 	enumerable: true,
 	get: function() {
@@ -266,6 +283,12 @@ Object.defineProperty(exports, "getEffectiveThreadId", {
 		return getEffectiveThreadId;
 	}
 });
+Object.defineProperty(exports, "getHandlerFGAProvider", {
+	enumerable: true,
+	get: function() {
+		return getHandlerFGAProvider;
+	}
+});
 Object.defineProperty(exports, "getPublicWorkflowById", {
 	enumerable: true,
 	get: function() {
@@ -327,4 +350,4 @@ Object.defineProperty(exports, "validateThreadOwnership", {
 	}
 });
 
-//# sourceMappingURL=utils-dDLIDg8O.cjs.map
+//# sourceMappingURL=utils-BbYUI6Yn.cjs.map

package/dist/utils-BbYUI6Yn.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils-BbYUI6Yn.cjs","names":["authEE","HTTPException","isReservedRequestContextKey","MASTRA_RESOURCE_ID_KEY","MastraMemory"],"sources":["../src/server/fga-permissions.ts","../src/server/handlers/utils.ts"],"sourcesContent":["/**\n * Safe re-export of `MastraFGAPermissions` from `@mastra/core/auth/ee`.\n *\n * Why this shim exists:\n * `MastraFGAPermissions` was introduced in `@mastra/core@1.32.0`. Earlier\n * versions of `@mastra/core` ship `@mastra/core/auth/ee` but do not export\n * this constant. A direct named import (`import { MastraFGAPermissions }\n * from '@mastra/core/auth/ee'`) fails at ESM link time when this version\n * of `@mastra/server` is paired with `@mastra/core < 1.32.0`, taking the\n * entire user bundle down before any code runs.\n *\n * A namespace import tolerates missing names — `ns.MissingExport` is just\n * `undefined`, no link-time error. We then expose the permission map.\n *\n * Fallback values:\n * If the consuming `@mastra/core` does not export `MastraFGAPermissions`,\n * we substitute a hardcoded map of the canonical permission strings used\n * by routes in `@mastra/server`. This preserves the explicit RBAC\n * permission overrides those routes already had as string literals in\n * `@mastra/server@1.31.0` (e.g. `requiresPermission: \"agents:execute\"`\n * on `/v1/responses`). Without this fallback, `requiresPermission` would\n * be `undefined` on old core and the auth layer would derive the wrong\n * permission from the route path (e.g. `v1:write` instead of\n * `agents:execute`), breaking RBAC users who upgrade `@mastra/server`\n * but stay on `@mastra/core@1.31.0`.\n *\n * Once the consuming `@mastra/core` is on `1.32.0+` the values are real\n * and behaviour is identical to a direct named import.\n */\n\nimport * as authEE from '@mastra/core/auth/ee';\n\n// Canonical strings for the FGA permission keys actually referenced by\n// `@mastra/server` source. Mirrors `MastraFGAPermissions` in\n// `@mastra/core@1.32.0+` for these specific keys, and matches the string\n// literals previously hardcoded on the same routes in `@mastra/server@1.31.0`.\nconst FALLBACK_PERMISSIONS = {\n  AGENTS_CREATE: 'agents:create',\n  AGENTS_DELETE: 'agents:delete',\n  AGENTS_EXECUTE: 'agents:execute',\n  AGENTS_READ: 'agents:read',\n  MEMORY_DELETE: 'memory:delete',\n  MEMORY_READ: 'memory:read',\n  MEMORY_WRITE: 'memory:write',\n  TOOLS_EXECUTE: 'tools:execute',\n  TOOLS_READ: 'tools:read',\n  STORED_WORKFLOWS_READ: 'stored-workflows:read',\n  STORED_WORKFLOWS_WRITE: 'stored-workflows:write',\n  WORKFLOWS_EXECUTE: 'workflows:execute',\n  WORKFLOWS_READ: 'workflows:read',\n} as const;\n\nconst realPermissions = (authEE as any).MastraFGAPermissions;\n\n// Typed as `any` on purpose: consumers of `@mastra/server` may run their\n// typecheck against a `@mastra/core` that doesn't export `MastraFGAPermissions`\n// (anything < 1.32.0). Pinning to the real type would push that name into the\n// emitted `.d.ts` and break downstream typecheck. `any` lets the property\n// accesses (`MastraFGAPermissions.AGENTS_READ`) flow through cleanly on every\n// supported core.\nexport const MastraFGAPermissions: any =\n  realPermissions && Object.keys(realPermissions).length > 0 ? realPermissions : FALLBACK_PERMISSIONS;\n","import type { Mastra } from '@mastra/core';\nimport type { IFGAProvider, MastraFGAPermissionInput } from '@mastra/core/auth/ee';\nimport type { RequestContext } from '@mastra/core/di';\nimport { MastraMemory } from '@mastra/core/memory';\nimport type { Workflow } from '@mastra/core/workflows';\nimport {\n  MASTRA_AUTH_MODE_KEY,\n  MASTRA_RESOURCE_ID_KEY,\n  MASTRA_THREAD_ID_KEY,\n  isReservedRequestContextKey,\n} from '../constants';\nimport { MastraFGAPermissions } from '../fga-permissions';\nimport { HTTPException } from '../http-exception';\n\n/**\n * Resolves a workflow by id or registration key from the set Mastra exposes\n * publicly. Unlike `mastra.getWorkflowById`, this excludes hidden internal\n * workflows (e.g. a durable agent's backing loop), which must never be\n * runnable through HTTP routes.\n */\nexport function getPublicWorkflowById(mastra: Mastra, workflowId: string): Workflow | undefined {\n  const workflows = mastra.listWorkflows();\n  return (\n    Object.values(workflows).find(workflow => workflow.id === workflowId) ??\n    (Object.hasOwn(workflows, workflowId) ? workflows[workflowId] : undefined)\n  );\n}\n\n/**\n * Resolves the FGA provider a handler should use for this request, following\n * the same auth-mode-aware selection as the route-level checks: Studio auth\n * requests use `studio.fga` when it is configured, and everything else uses\n * `server.fga`.\n *\n * Returns `undefined` when FGA is not configured at all. When FGA is\n * configured but no provider applies to this request (for example `studio.fga`\n * is set and the request used server auth), the request is denied rather than\n * treated as unrestricted.\n */\nexport function getHandlerFGAProvider(mastra: any, requestContext?: RequestContext): IFGAProvider | undefined {\n  const studioFga = mastra?.getStudio?.()?.fga as IFGAProvider | undefined;\n  const serverFga = mastra?.getServer?.()?.fga as IFGAProvider | undefined;\n\n  if (requestContext?.get(MASTRA_AUTH_MODE_KEY) === 'studio' && studioFga) return studioFga;\n  if (serverFga) return serverFga;\n  if (studioFga) {\n    throw new HTTPException(403, { message: 'Access denied: no FGA provider is configured for this request' });\n  }\n  return undefined;\n}\n\n// Validation helper\nexport function validateBody(body: Record<string, unknown>) {\n  const errorResponse = Object.entries(body).reduce<Record<string, string>>((acc, [key, value]) => {\n    if (!value) {\n      acc[key] = `Argument \"${key}\" is required`;\n    }\n    return acc;\n  }, {});\n\n  if (Object.keys(errorResponse).length > 0) {\n    throw new HTTPException(400, { message: Object.values(errorResponse)[0] });\n  }\n}\n\n/**\n * sanitizes the body by removing disallowed keys.\n * @param body body to sanitize\n * @param disallowedKeys keys to remove from the body\n */\nexport function sanitizeBody(body: Record<string, unknown>, disallowedKeys: string[]) {\n  for (const key of disallowedKeys) {\n    if (key in body) {\n      delete body[key];\n    }\n  }\n}\n\nconst CREDENTIAL_HEADER_NAMES = new Set([\n  'authorization',\n  'proxy-authorization',\n  'x-api-key',\n  'api-key',\n  'x-goog-api-key',\n  'cookie',\n]);\n\n/**\n * Removes credential-bearing headers from client-supplied `modelSettings.headers`\n * so a caller's own auth (e.g. the app's bearer token) can never override the\n * provider credential configured on the server. Non-credential headers are kept.\n */\nexport function stripClientCredentialHeaders(body: Record<string, unknown>) {\n  const modelSettings = body.modelSettings;\n  if (!modelSettings || typeof modelSettings !== 'object') return;\n  const headers = (modelSettings as { headers?: unknown }).headers;\n  if (!headers || typeof headers !== 'object') return;\n\n  const kept = Object.fromEntries(\n    Object.entries(headers).filter(([name]) => !CREDENTIAL_HEADER_NAMES.has(name.toLowerCase())),\n  );\n  body.modelSettings = { ...modelSettings, headers: kept };\n}\n\nexport function parsePerPage(\n  value: string | undefined,\n  defaultValue: number = 100,\n  max: number = 1000,\n): number | false {\n  const normalized = (value || '').trim().toLowerCase();\n  // Handle explicit false to bypass pagination\n  if (normalized === 'false') {\n    return false;\n  }\n  const parsed = parseInt(value || String(defaultValue), 10);\n  if (isNaN(parsed)) return defaultValue;\n  return Math.min(max, Math.max(1, parsed));\n}\n\n/**\n * Parses filter query parameters into a key-value object.\n */\nexport function parseFilters(filters: string | string[] | undefined): Record<string, string> | undefined {\n  if (!filters) return undefined;\n\n  return Object.fromEntries(\n    (Array.isArray(filters) ? filters : [filters]).map((attr: string) => {\n      const [key, ...valueParts] = attr.split(':');\n      const value = valueParts.join(':'); // ✅ Handles colons in values\n      return [key, value];\n    }),\n  );\n}\n\n/**\n * Merges a body-supplied requestContext into the trusted server RequestContext.\n * The server context is authoritative: reserved keys are skipped and body values\n * only fill keys the server context has not already set.\n */\nexport function mergeBodyRequestContext(serverRequestContext: RequestContext, bodyRequestContext: unknown): void {\n  if (!bodyRequestContext || typeof bodyRequestContext !== 'object') {\n    return;\n  }\n\n  for (const [key, value] of Object.entries(bodyRequestContext)) {\n    if (isReservedRequestContextKey(key)) continue;\n    if (serverRequestContext.get(key) === undefined) {\n      serverRequestContext.set(key, value);\n    }\n  }\n}\n\n// ============================================================================\n// Authorization Utilities\n// ============================================================================\n\n/**\n * Gets the effective resourceId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveResourceId(\n  requestContext: RequestContext | undefined,\n  clientResourceId: string | undefined,\n): string | undefined {\n  const contextResourceId = requestContext?.get(MASTRA_RESOURCE_ID_KEY) as string | undefined;\n  return contextResourceId || clientResourceId;\n}\n\n/**\n * Returns the resource id resolved from the request context alone (set via\n * `mapUserToResourceId` or the `x-resource-id` header), ignoring any\n * client-provided value. Its presence indicates a resource-scoped caller;\n * its absence indicates a privileged/service context.\n */\nexport function getContextResourceId(requestContext: RequestContext | undefined): string | undefined {\n  return requestContext?.get(MASTRA_RESOURCE_ID_KEY) as string | undefined;\n}\n\n/**\n * Ensures a memory request has a resolvable resource ID. The body's\n * `memory.resource` is optional so authenticated setups can rely on the\n * server-derived resource ID (MASTRA_RESOURCE_ID_KEY set via mapUserToResourceId).\n * When neither the body nor the request context provides one, reject with a\n * clear 400 instead of failing deep inside agent execution.\n */\nexport function requireEffectiveResourceId(\n  effectiveResourceId: string | undefined,\n): asserts effectiveResourceId is string {\n  if (!effectiveResourceId) {\n    throw new HTTPException(400, {\n      message:\n        'A resource ID is required when using memory. Provide memory.resource in the request body, or configure server auth with mapUserToResourceId to derive it from the authenticated user.',\n    });\n  }\n}\n\n/**\n * Gets the effective threadId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveThreadId(\n  requestContext: RequestContext | undefined,\n  clientThreadId: string | undefined,\n): string | undefined {\n  const contextThreadId = requestContext?.get(MASTRA_THREAD_ID_KEY) as string | undefined;\n  return contextThreadId || clientThreadId;\n}\n\n/**\n * Applies the effective threadId to a client memory thread option. Object\n * threads keep their other fields (metadata, title, ...) so they reach thread\n * creation; a client-supplied resourceId is dropped because the server decides\n * the resource.\n */\nexport function applyEffectiveThreadId<T extends string | { id: string } | undefined>(\n  thread: T,\n  effectiveThreadId: string | undefined,\n): T | string {\n  if (!effectiveThreadId) return thread;\n  if (thread && typeof thread === 'object') {\n    const { resourceId: _resourceId, ...fields } = thread as { id: string; resourceId?: unknown };\n    return { ...fields, id: effectiveThreadId } as T;\n  }\n  return effectiveThreadId;\n}\n\n/**\n * Validates that a thread belongs to the specified resourceId.\n * Throws 403 if the thread exists but belongs to a different resource.\n * Threads with no resourceId are accessible to all (shared threads).\n */\nexport async function validateThreadOwnership(\n  thread: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (thread && effectiveResourceId && thread.resourceId && thread.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: thread belongs to a different resource' });\n  }\n}\n\n/**\n * Validates both coarse resource ownership and fine-grained thread access.\n * FGA enforcement is a no-op when no FGA provider is configured.\n */\nexport async function enforceThreadAccess({\n  mastra,\n  requestContext,\n  threadId,\n  thread,\n  effectiveResourceId,\n  permission = MastraFGAPermissions.MEMORY_READ,\n}: {\n  mastra: any;\n  requestContext?: RequestContext;\n  threadId: string;\n  thread?: { resourceId?: string | null } | null;\n  effectiveResourceId?: string;\n  permission?: MastraFGAPermissionInput;\n}): Promise<void> {\n  await validateThreadOwnership(thread, effectiveResourceId);\n\n  const fgaProvider = getHandlerFGAProvider(mastra, requestContext);\n  if (!fgaProvider) {\n    return;\n  }\n\n  const user = requestContext?.get('user');\n  if (!user || typeof user !== 'object') {\n    throw new HTTPException(403, { message: 'FGA authorization denied: authenticated user is required' });\n  }\n\n  await MastraMemory.checkThreadFGA({\n    mastra,\n    user: user as { id: string; [key: string]: unknown },\n    threadId,\n    resourceId: thread?.resourceId ?? effectiveResourceId,\n    requestContext,\n    permission,\n    fgaProvider,\n  });\n}\n\n/**\n * Validates that a caller may act on a workflow run.\n *\n * Without `server.auth.mapUserToResourceId` there is no tenancy model, and only a mismatch\n * between two present resource ids is denied. With a mapper, a resource-scoped caller may only\n * act on runs it owns (an owner-less run is not its run). An unscoped caller is a\n * privileged/service context (see getContextResourceId), but that privilege is only granted when\n * an FGA provider authorizes the route; otherwise it is refused rather than granted implicitly,\n * as on the thread-transfer route.\n */\nexport async function validateRunOwnership(\n  run: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n  mastra?: {\n    getServer?: () => { auth?: unknown; fga?: unknown } | undefined;\n    getStudio?: () => { fga?: unknown } | undefined;\n  },\n  requestContext?: RequestContext,\n): Promise<void> {\n  if (!run) return;\n  const server = mastra?.getServer?.();\n  const tenancy =\n    typeof (server?.auth as { mapUserToResourceId?: unknown } | undefined)?.mapUserToResourceId === 'function';\n  if (!tenancy) {\n    if (effectiveResourceId && run.resourceId && run.resourceId !== effectiveResourceId) {\n      throw new HTTPException(403, { message: 'Access denied: workflow run belongs to a different resource' });\n    }\n    return;\n  }\n  if (effectiveResourceId) {\n    if (run.resourceId !== effectiveResourceId) {\n      throw new HTTPException(403, { message: 'Access denied: workflow run belongs to a different resource' });\n    }\n    return;\n  }\n  if (!getHandlerFGAProvider(mastra, requestContext)) {\n    throw new HTTPException(403, {\n      message:\n        'Access denied: unscoped workflow run access requires explicit authorization. Configure an FGA provider to authorize privileged run access.',\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,MAAM,uBAAuB;CAC3B,eAAe;CACf,eAAe;CACf,gBAAgB;CAChB,aAAa;CACb,eAAe;CACf,aAAa;CACb,cAAc;CACd,eAAe;CACf,YAAY;CACZ,uBAAuB;CACvB,wBAAwB;CACxB,mBAAmB;CACnB,gBAAgB;AAClB;AAEA,MAAM,kBAAmBA,qBAAe;AAQxC,MAAa,uBACX,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,IAAI,kBAAkB;;;;;;;;ACzCjF,SAAgB,sBAAsB,QAAgB,YAA0C;CAC9F,MAAM,YAAY,OAAO,cAAc;CACvC,OACE,OAAO,OAAO,SAAS,CAAC,CAAC,MAAK,aAAY,SAAS,OAAO,UAAU,MACnE,OAAO,OAAO,WAAW,UAAU,IAAI,UAAU,cAAc,KAAA;AAEpE;;;;;;;;;;;;AAaA,SAAgB,sBAAsB,QAAa,gBAA2D;CAC5G,MAAM,YAAY,QAAQ,YAAY,CAAC,EAAE;CACzC,MAAM,YAAY,QAAQ,YAAY,CAAC,EAAE;CAEzC,IAAI,gBAAgB,IAAA,kBAAwB,MAAM,YAAY,WAAW,OAAO;CAChF,IAAI,WAAW,OAAO;CACtB,IAAI,WACF,MAAM,IAAIC,uBAAAA,cAAc,KAAK,EAAE,SAAS,gEAAgE,CAAC;AAG7G;AAGA,SAAgB,aAAa,MAA+B;CAC1D,MAAM,gBAAgB,OAAO,QAAQ,IAAI,CAAC,CAAC,QAAgC,KAAK,CAAC,KAAK,WAAW;EAC/F,IAAI,CAAC,OACH,IAAI,OAAO,aAAa,IAAI;EAE9B,OAAO;CACT,GAAG,CAAC,CAAC;CAEL,IAAI,OAAO,KAAK,aAAa,CAAC,CAAC,SAAS,GACtC,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,OAAO,OAAO,aAAa,CAAC,CAAC,GAAG,CAAC;AAE7E;;;;;;AAOA,SAAgB,aAAa,MAA+B,gBAA0B;CACpF,KAAK,MAAM,OAAO,gBAChB,IAAI,OAAO,MACT,OAAO,KAAK;AAGlB;AAEA,MAAM,0CAA0B,IAAI,IAAI;CACtC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,SAAgB,6BAA6B,MAA+B;CAC1E,MAAM,gBAAgB,KAAK;CAC3B,IAAI,CAAC,iBAAiB,OAAO,kBAAkB,UAAU;CACzD,MAAM,UAAW,cAAwC;CACzD,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU;CAE7C,MAAM,OAAO,OAAO,YAClB,OAAO,QAAQ,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,wBAAwB,IAAI,KAAK,YAAY,CAAC,CAAC,CAC7F;CACA,KAAK,gBAAgB;EAAE,GAAG;EAAe,SAAS;CAAK;AACzD;AAEA,SAAgB,aACd,OACA,eAAuB,KACvB,MAAc,KACE;CAGhB,KAFoB,SAAS,GAAA,CAAI,KAAK,CAAC,CAAC,YAE3B,MAAM,SACjB,OAAO;CAET,MAAM,SAAS,SAAS,SAAS,OAAO,YAAY,GAAG,EAAE;CACzD,IAAI,MAAM,MAAM,GAAG,OAAO;CAC1B,OAAO,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,MAAM,CAAC;AAC1C;;;;AAKA,SAAgB,aAAa,SAA4E;CACvG,IAAI,CAAC,SAAS,OAAO,KAAA;CAErB,OAAO,OAAO,aACX,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO,EAAA,CAAG,KAAK,SAAiB;EACnE,MAAM,CAAC,KAAK,GAAG,cAAc,KAAK,MAAM,GAAG;EAE3C,OAAO,CAAC,KADM,WAAW,KAAK,GACb,CAAC;CACpB,CAAC,CACH;AACF;;;;;;AAOA,SAAgB,wBAAwB,sBAAsC,oBAAmC;CAC/G,IAAI,CAAC,sBAAsB,OAAO,uBAAuB,UACvD;CAGF,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,kBAAkB,GAAG;EAC7D,IAAIC,kBAAAA,4BAA4B,GAAG,GAAG;EACtC,IAAI,qBAAqB,IAAI,GAAG,MAAM,KAAA,GACpC,qBAAqB,IAAI,KAAK,KAAK;CAEvC;AACF;;;;;AAUA,SAAgB,uBACd,gBACA,kBACoB;CAEpB,OAD0B,gBAAgB,IAAA,oBAA0B,KACxC;AAC9B;;;;;;;AAQA,SAAgB,qBAAqB,gBAAgE;CACnG,OAAO,gBAAgB,IAAIC,kBAAAA,sBAAsB;AACnD;;;;;;;;AASA,SAAgB,2BACd,qBACuC;CACvC,IAAI,CAAC,qBACH,MAAM,IAAIF,uBAAAA,cAAc,KAAK,EAC3B,SACE,wLACJ,CAAC;AAEL;;;;;AAMA,SAAgB,qBACd,gBACA,gBACoB;CAEpB,OADwB,gBAAgB,IAAA,kBAAwB,KACtC;AAC5B;;;;;;;AAQA,SAAgB,uBACd,QACA,mBACY;CACZ,IAAI,CAAC,mBAAmB,OAAO;CAC/B,IAAI,UAAU,OAAO,WAAW,UAAU;EACxC,MAAM,EAAE,YAAY,aAAa,GAAG,WAAW;EAC/C,OAAO;GAAE,GAAG;GAAQ,IAAI;EAAkB;CAC5C;CACA,OAAO;AACT;;;;;;AAOA,eAAsB,wBACpB,QACA,qBACe;CACf,IAAI,UAAU,uBAAuB,OAAO,cAAc,OAAO,eAAe,qBAC9E,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,wDAAwD,CAAC;AAErG;;;;;AAMA,eAAsB,oBAAoB,EACxC,QACA,gBACA,UACA,QACA,qBACA,aAAa,qBAAqB,eAQlB;CAChB,MAAM,wBAAwB,QAAQ,mBAAmB;CAEzD,MAAM,cAAc,sBAAsB,QAAQ,cAAc;CAChE,IAAI,CAAC,aACH;CAGF,MAAM,OAAO,gBAAgB,IAAI,MAAM;CACvC,IAAI,CAAC,QAAQ,OAAO,SAAS,UAC3B,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,2DAA2D,CAAC;CAGtG,MAAMG,oBAAAA,aAAa,eAAe;EAChC;EACM;EACN;EACA,YAAY,QAAQ,cAAc;EAClC;EACA;EACA;CACF,CAAC;AACH;;;;;;;;;;;AAYA,eAAsB,qBACpB,KACA,qBACA,QAIA,gBACe;CACf,IAAI,CAAC,KAAK;CAIV,IAAI,EADF,SAFa,QAAQ,YAAY,EAAA,EAEjB,KAAA,EAAwD,wBAAwB,aACpF;EACZ,IAAI,uBAAuB,IAAI,cAAc,IAAI,eAAe,qBAC9D,MAAM,IAAIH,uBAAAA,cAAc,KAAK,EAAE,SAAS,8DAA8D,CAAC;EAEzG;CACF;CACA,IAAI,qBAAqB;EACvB,IAAI,IAAI,eAAe,qBACrB,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,8DAA8D,CAAC;EAEzG;CACF;CACA,IAAI,CAAC,sBAAsB,QAAQ,cAAc,GAC/C,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAC3B,SACE,6IACJ,CAAC;AAEL"}