@mastra/server 1.81.0 → 1.82.0-alpha.1

package/dist/system-iruN6xnj.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-iruN6xnj.cjs","names":["z"],"sources":["../src/server/schemas/system.ts"],"sourcesContent":["import { z } from 'zod/v4';\n\nexport const mastraPackageSchema = z.object({\n  name: z.string(),\n  version: z.string(),\n});\n\nexport const observabilityRuntimeStrategySchema = z.enum([\n  'realtime',\n  'batch-with-updates',\n  'insert-only',\n  'event-sourced',\n]);\n\nexport const observabilityDiscoveryCapabilitiesSchema = z.object({\n  entityTypes: z.boolean().describe('GET /observability/discovery/entity-types'),\n  entityNames: z.boolean().describe('GET /observability/discovery/entity-names'),\n  serviceNames: z.boolean().describe('GET /observability/discovery/service-names'),\n  environments: z.boolean().describe('GET /observability/discovery/environments'),\n  tags: z.boolean().describe('GET /observability/discovery/tags'),\n  metrics: z.boolean().describe('GET /observability/discovery/metric-names, metric-label-keys and metric-label-values'),\n});\n\n/**\n * Optional observability APIs the configured observability store can serve.\n * Omitted when no observability store is configured.\n */\nexport const observabilityStorageCapabilitiesSchema = z.object({\n  metrics: z.boolean().describe('Metrics endpoints (/observability/metrics and /observability/metrics/*)'),\n  logs: z.boolean().describe('Logs endpoint (GET /observability/logs)'),\n  discovery: observabilityDiscoveryCapabilitiesSchema.describe(\n    'Filter discovery endpoints. Unsupported discovery routes return empty results.',\n  ),\n  deltaPolling: z.boolean().describe(\"Cursor-based `mode: 'delta'` polling on observability list endpoints\"),\n  traceQuery: z\n    .boolean()\n    .describe(\n      'Advanced trace queries (POST /observability/traces/query). When false, list traces with GET /observability/traces/light instead.',\n    ),\n  traceQueryRootDuration: z.boolean().describe('`durationMs` predicates in trace and thread queries'),\n  traceQueryContextIds: z\n    .boolean()\n    .describe('`runId`, `sessionId`, `userId` and `organizationId` predicates in trace and thread queries'),\n  traceQueryTimeToFirstChunk: z\n    .boolean()\n    .describe(\n      '`timeToFirstChunkMs` in trace and span query results, and predicates on it in trace, thread and span queries',\n    ),\n  traceQueryRootSpanFields: z\n    .boolean()\n    .describe('Root span `name` and `spanType` in trace-scope predicates, aggregate `groupBy` and `countDistinct`'),\n  traceQueryRootEntityId: z\n    .boolean()\n    .describe('Root span `entityId` in trace-scope predicates, aggregate `groupBy` and `countDistinct`'),\n  traceQueryTimeToFirstChunkSort: z.boolean().describe('Sorting trace and span queries by `timeToFirstChunkMs`'),\n  traceQueryTimeToFirstToken: z\n    .boolean()\n    .describe(\n      '`timeToFirstTokenMs` in trace, thread and span query results, and predicates on it in trace, thread and span queries',\n    ),\n  traceQueryTimeToFirstTokenSort: z.boolean().describe('Sorting trace and span queries by `timeToFirstTokenMs`'),\n  traceQueryDiscovery: z\n    .boolean()\n    .describe('Trace query field discovery (POST /observability/traces/query/fields and /values)'),\n  traceQueryTenantScope: z.boolean().describe('Trusted tenant scoping of trace and thread queries'),\n  traceAggregate: z\n    .boolean()\n    .describe(\n      'Trace aggregation (POST /observability/traces/aggregate). Unlike `traceQuery`, clients should treat a missing value as unavailable.',\n    ),\n  spanAggregate: z\n    .boolean()\n    .describe(\n      'Span aggregation (POST /observability/spans/aggregate). Unlike `spanQuery`, clients should treat a missing value as unavailable.',\n    ),\n  threadQuery: z.boolean().describe('Advanced thread queries (POST /observability/threads/query)'),\n  threadQueryRows: z\n    .boolean()\n    .default(false)\n    .describe(\n      'Full-history thread rows with activity windows, filters and sorting. Treat a missing value as unavailable.',\n    ),\n  spanQuery: z.boolean().describe('Span queries (POST /observability/spans/query)'),\n  spanQueryContextFields: z\n    .boolean()\n    .default(false)\n    .describe(\n      'Additional identity, context and parent/root entity predicates in span queries. Treat a missing value as unavailable.',\n    ),\n  spanQueryModelFields: z\n    .boolean()\n    .default(false)\n    .describe(\n      '`model` and `provider` predicates in span queries and span aggregates. Treat a missing value as unavailable.',\n    ),\n  spanAggregateModelDimensions: z\n    .boolean()\n    .default(false)\n    .describe(\n      '`model` and `provider` in span aggregate `groupBy` and `countDistinct`. Treat a missing value as unavailable.',\n    ),\n  aggregateTimeToFirstMeasures: z\n    .boolean()\n    .default(false)\n    .describe(\n      '`timeToFirstToken.*` and `timeToFirstChunk.*` measures in trace and span aggregates. Treat a missing value as unavailable.',\n    ),\n  spanQueryOutcomeFields: z\n    .boolean()\n    .default(false)\n    .describe(\n      '`outcome` and `stopReason` predicates in span queries and span aggregates (including `groupBy` and `countDistinct`), and `outcome`, `stopReason` and `stopReasonContext` on span rows. Treat a missing value as unavailable.',\n    ),\n  traceQueryOutcomeFields: z\n    .boolean()\n    .default(false)\n    .describe(\n      \"The root span's `outcome` and `stopReason` in trace-scope predicates and trace aggregates, both fields in `spans.some`/`spans.none` predicates and value discovery, and the root span's `outcome`, `stopReason` and `stopReasonContext` on trace rows. Treat a missing value as unavailable.\",\n    ),\n  traceRetentionDays: z\n    .number()\n    .int()\n    .positive()\n    .optional()\n    .describe(\n      'Days of traces the store keeps. Older traces are gone, so clients can stop users from picking dates before them. Omitted when the store does not report a limit.',\n    ),\n  feedback: z\n    .boolean()\n    .describe(\n      'Feedback endpoints (/observability/feedback and /observability/feedback/*). Unsupported feedback routes return 501.',\n    ),\n});\n\nexport const editorSourceSchema = z.enum(['code', 'db']);\n\nexport const editorSourceCapabilitiesSchema = z.object({\n  source: editorSourceSchema,\n  storage: z.enum(['database', 'filesystem', 'source-provider', 'unavailable']),\n  provider: z\n    .object({\n      id: z.string(),\n      displayName: z.string(),\n    })\n    .optional(),\n  canSave: z.boolean(),\n  canOpenChangeRequest: z.boolean(),\n  unavailableReason: z.string().optional(),\n});\n\nexport const systemPackagesResponseSchema = z.object({\n  packages: z.array(mastraPackageSchema),\n  isDev: z.boolean(),\n  cmsEnabled: z.boolean(),\n  /** Whether the default LiveKit connection-details route is registered — not whether credentials or a worker exist. */\n  liveKitConnectionRouteEnabled: z.boolean(),\n  /** True when the default LiveKit trace recording review route is registered. */\n  liveKitRecordingRouteEnabled: z.boolean().optional(),\n  /**\n   * The editor's configured source, when set. `'code'` swaps Studio's\n   * Save/Publish UI for Download JSON + Open PR. `'db'` keeps the standard\n   * Save/Publish flow. Omitted when the editor has no explicit source.\n   */\n  editorSource: editorSourceSchema.optional(),\n  editorSourceCapabilities: editorSourceCapabilitiesSchema.optional(),\n  observabilityEnabled: z.boolean(),\n  storageType: z.string().optional(),\n  observabilityStorageType: z.string().optional(),\n  observabilityStorageCapabilities: observabilityStorageCapabilitiesSchema.optional(),\n  observabilityRuntimeStrategy: observabilityRuntimeStrategySchema.optional(),\n});\n\nconst jsonSchemaRecordSchema = z.record(z.string(), z.unknown());\n\nexport const apiSchemaResponseShapeSchema = z.object({\n  kind: z.enum(['array', 'record', 'object-property', 'single', 'unknown']),\n  listProperty: z.string().optional(),\n  paginationProperty: z.string().optional(),\n});\n\nexport const apiSchemaManifestRouteSchema = z.object({\n  method: z.string(),\n  path: z.string(),\n  responseType: z.string(),\n  pathParamSchema: jsonSchemaRecordSchema.optional(),\n  queryParamSchema: jsonSchemaRecordSchema.optional(),\n  bodySchema: jsonSchemaRecordSchema.optional(),\n  responseSchema: jsonSchemaRecordSchema.optional(),\n  responseShape: apiSchemaResponseShapeSchema,\n});\n\nexport const apiSchemaManifestResponseSchema = z.object({\n  version: z.literal(1),\n  routes: z.array(apiSchemaManifestRouteSchema),\n});\n\nexport type MastraPackage = z.infer<typeof mastraPackageSchema>;\nexport type SystemPackagesResponse = z.infer<typeof systemPackagesResponseSchema>;\n"],"mappings":";;AAEA,MAAa,sBAAsBA,OAAAA,EAAE,OAAO;CAC1C,MAAMA,OAAAA,EAAE,OAAO;CACf,SAASA,OAAAA,EAAE,OAAO;AACpB,CAAC;AAED,MAAa,qCAAqCA,OAAAA,EAAE,KAAK;CACvD;CACA;CACA;CACA;AACF,CAAC;AAED,MAAa,2CAA2CA,OAAAA,EAAE,OAAO;CAC/D,aAAaA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS,2CAA2C;CAC7E,aAAaA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS,2CAA2C;CAC7E,cAAcA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS,4CAA4C;CAC/E,cAAcA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS,2CAA2C;CAC9E,MAAMA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS,mCAAmC;CAC9D,SAASA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS,sFAAsF;AACtH,CAAC;;;;;AAMD,MAAa,yCAAyCA,OAAAA,EAAE,OAAO;CAC7D,SAASA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS,yEAAyE;CACvG,MAAMA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS,yCAAyC;CACpE,WAAW,yCAAyC,SAClD,gFACF;CACA,cAAcA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS,sEAAsE;CACzG,YAAYA,OAAAA,EACT,QAAQ,CAAC,CACT,SACC,kIACF;CACF,wBAAwBA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS,qDAAqD;CAClG,sBAAsBA,OAAAA,EACnB,QAAQ,CAAC,CACT,SAAS,4FAA4F;CACxG,4BAA4BA,OAAAA,EACzB,QAAQ,CAAC,CACT,SACC,8GACF;CACF,0BAA0BA,OAAAA,EACvB,QAAQ,CAAC,CACT,SAAS,oGAAoG;CAChH,wBAAwBA,OAAAA,EACrB,QAAQ,CAAC,CACT,SAAS,yFAAyF;CACrG,gCAAgCA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS,wDAAwD;CAC7G,4BAA4BA,OAAAA,EACzB,QAAQ,CAAC,CACT,SACC,sHACF;CACF,gCAAgCA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS,wDAAwD;CAC7G,qBAAqBA,OAAAA,EAClB,QAAQ,CAAC,CACT,SAAS,mFAAmF;CAC/F,uBAAuBA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS,oDAAoD;CAChG,gBAAgBA,OAAAA,EACb,QAAQ,CAAC,CACT,SACC,qIACF;CACF,eAAeA,OAAAA,EACZ,QAAQ,CAAC,CACT,SACC,kIACF;CACF,aAAaA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS,6DAA6D;CAC/F,iBAAiBA,OAAAA,EACd,QAAQ,CAAC,CACT,QAAQ,KAAK,CAAC,CACd,SACC,4GACF;CACF,WAAWA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS,gDAAgD;CAChF,wBAAwBA,OAAAA,EACrB,QAAQ,CAAC,CACT,QAAQ,KAAK,CAAC,CACd,SACC,uHACF;CACF,sBAAsBA,OAAAA,EACnB,QAAQ,CAAC,CACT,QAAQ,KAAK,CAAC,CACd,SACC,8GACF;CACF,8BAA8BA,OAAAA,EAC3B,QAAQ,CAAC,CACT,QAAQ,KAAK,CAAC,CACd,SACC,+GACF;CACF,8BAA8BA,OAAAA,EAC3B,QAAQ,CAAC,CACT,QAAQ,KAAK,CAAC,CACd,SACC,4HACF;CACF,wBAAwBA,OAAAA,EACrB,QAAQ,CAAC,CACT,QAAQ,KAAK,CAAC,CACd,SACC,8NACF;CACF,yBAAyBA,OAAAA,EACtB,QAAQ,CAAC,CACT,QAAQ,KAAK,CAAC,CACd,SACC,8RACF;CACF,oBAAoBA,OAAAA,EACjB,OAAO,CAAC,CACR,IAAI,CAAC,CACL,SAAS,CAAC,CACV,SAAS,CAAC,CACV,SACC,kKACF;CACF,UAAUA,OAAAA,EACP,QAAQ,CAAC,CACT,SACC,qHACF;AACJ,CAAC;AAED,MAAa,qBAAqBA,OAAAA,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC;AAEvD,MAAa,iCAAiCA,OAAAA,EAAE,OAAO;CACrD,QAAQ;CACR,SAASA,OAAAA,EAAE,KAAK;EAAC;EAAY;EAAc;EAAmB;CAAa,CAAC;CAC5E,UAAUA,OAAAA,EACP,OAAO;EACN,IAAIA,OAAAA,EAAE,OAAO;EACb,aAAaA,OAAAA,EAAE,OAAO;CACxB,CAAC,CAAC,CACD,SAAS;CACZ,SAASA,OAAAA,EAAE,QAAQ;CACnB,sBAAsBA,OAAAA,EAAE,QAAQ;CAChC,mBAAmBA,OAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AACzC,CAAC;AAED,MAAa,+BAA+BA,OAAAA,EAAE,OAAO;CACnD,UAAUA,OAAAA,EAAE,MAAM,mBAAmB;CACrC,OAAOA,OAAAA,EAAE,QAAQ;CACjB,YAAYA,OAAAA,EAAE,QAAQ;;CAEtB,+BAA+BA,OAAAA,EAAE,QAAQ;;CAEzC,8BAA8BA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;;;;;;CAMnD,cAAc,mBAAmB,SAAS;CAC1C,0BAA0B,+BAA+B,SAAS;CAClE,sBAAsBA,OAAAA,EAAE,QAAQ;CAChC,aAAaA,OAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACjC,0BAA0BA,OAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9C,kCAAkC,uCAAuC,SAAS;CAClF,8BAA8B,mCAAmC,SAAS;AAC5E,CAAC;AAED,MAAM,yBAAyBA,OAAAA,EAAE,OAAOA,OAAAA,EAAE,OAAO,GAAGA,OAAAA,EAAE,QAAQ,CAAC;AAE/D,MAAa,+BAA+BA,OAAAA,EAAE,OAAO;CACnD,MAAMA,OAAAA,EAAE,KAAK;EAAC;EAAS;EAAU;EAAmB;EAAU;CAAS,CAAC;CACxE,cAAcA,OAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,oBAAoBA,OAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAC1C,CAAC;AAED,MAAa,+BAA+BA,OAAAA,EAAE,OAAO;CACnD,QAAQA,OAAAA,EAAE,OAAO;CACjB,MAAMA,OAAAA,EAAE,OAAO;CACf,cAAcA,OAAAA,EAAE,OAAO;CACvB,iBAAiB,uBAAuB,SAAS;CACjD,kBAAkB,uBAAuB,SAAS;CAClD,YAAY,uBAAuB,SAAS;CAC5C,gBAAgB,uBAAuB,SAAS;CAChD,eAAe;AACjB,CAAC;AAED,MAAa,kCAAkCA,OAAAA,EAAE,OAAO;CACtD,SAASA,OAAAA,EAAE,QAAQ,CAAC;CACpB,QAAQA,OAAAA,EAAE,MAAM,4BAA4B;AAC9C,CAAC"}

package/dist/{tools-BFpuzQsz.js → tools-CtELrYsA.js}

@@ -4,10 +4,10 @@ import { o as optionalRunIdSchema } from "./common-J-yUnHk9.js";
 import { D as listToolsResponseSchema, J as serializedToolSchema, S as executeToolResponseSchema, b as executeToolBodySchema, et as toolIdPathParams, u as agentToolPathParams, x as executeToolContextBodySchema } from "./agents-B5kq2QEV.js";
 import { n as standardSchemaToJSONSchema, r as toStandardSchema } from "./schema-Bf12g7KC-DBc4NSds.js";
 import { n as createRoute } from "./route-builder-BxPrwNog.js";
-import { l as stringify } from "./utils-YEuwVEc2.js";
+import { l as stringify } from "./utils-qaBKOShQ.js";
 import { handleError } from "./server/handlers/error.js";
-import { _ as MastraFGAPermissions, m as validateBody, o as getHandlerFGAProvider } from "./utils-DHxjw4Tn.js";
-import { G as getAgentFromSystem } from "./agents-BuI0JjjX.js";
+import { _ as MastraFGAPermissions, m as validateBody, o as getHandlerFGAProvider } from "./utils-B15w-1hm.js";
+import { G as getAgentFromSystem } from "./agents-NRBk4JAs.js";
 import { stripInjectedToolOverrideFields } from "./server/handlers/tool-schema-overrides.js";
 import { isProviderDefinedTool, isVercelTool } from "@mastra/core/tools";
 // src/server/handlers/tools.ts
@@ -252,4 +252,4 @@ const EXECUTE_AGENT_TOOL_ROUTE = createRoute({
 });
 export { LIST_TOOLS_ROUTE as a, GET_TOOL_BY_ID_ROUTE as i, EXECUTE_TOOL_ROUTE as n, tools_exports as o, GET_AGENT_TOOL_ROUTE as r, EXECUTE_AGENT_TOOL_ROUTE as t };
 
-//# sourceMappingURL=tools-BFpuzQsz.js.map
+//# sourceMappingURL=tools-CtELrYsA.js.map

package/dist/{tools-BFpuzQsz.js.map → tools-CtELrYsA.js.map}

@@ -1 +1 @@
-{"version":3,"file":"tools-BFpuzQsz.js","names":[],"sources":["../src/server/handlers/tools.ts"],"sourcesContent":["import { isVercelTool, isProviderDefinedTool } from '@mastra/core/tools';\nimport { toStandardSchema, standardSchemaToJSONSchema } from '@mastra/schema-compat/schema';\nimport type { PublicSchema } from '@mastra/schema-compat/schema';\nimport { stringify } from 'superjson';\nimport { MastraFGAPermissions } from '../fga-permissions';\nimport { HTTPException } from '../http-exception';\nimport {\n  executeToolContextBodySchema,\n  executeToolResponseSchema,\n  listToolsResponseSchema,\n  serializedToolSchema,\n  toolIdPathParams,\n  agentToolPathParams,\n  executeToolBodySchema,\n} from '../schemas/agents';\nimport { optionalRunIdSchema } from '../schemas/common';\nimport { createRoute } from '../server-adapter/routes/route-builder';\n\nimport { getAgentFromSystem } from './agents';\nimport { handleError } from './error';\nimport { stripInjectedToolOverrideFields } from './tool-schema-overrides';\nimport { getHandlerFGAProvider, validateBody } from './utils';\n\n/**\n * Resolves a schema that may be a lazy function (e.g. AI SDK provider tools).\n * Recursively resolves until a non-function value is returned.\n * Skips functions that are themselves valid schemas (e.g. ArkType types are\n * callable but also implement StandardSchema via ~standard).\n */\nfunction resolveLazySchema(schema: unknown): unknown {\n  if (typeof schema === 'function' && !('~standard' in schema)) {\n    return resolveLazySchema(schema());\n  }\n  return schema;\n}\n\nfunction schemaToJsonSchema(schema: PublicSchema<unknown> | undefined) {\n  if (!schema) {\n    return undefined;\n  }\n\n  return standardSchemaToJSONSchema(toStandardSchema(schema), { target: 'draft-2020-12' });\n}\n\nfunction serializeSchema(schema: unknown, options?: { stripInjectedOverrides?: boolean }): string | undefined {\n  const jsonSchema = schemaToJsonSchema(resolveLazySchema(schema) as PublicSchema<unknown> | undefined);\n  if (jsonSchema === undefined) return undefined;\n  return stringify(options?.stripInjectedOverrides ? stripInjectedToolOverrideFields(jsonSchema) : jsonSchema);\n}\n\n/**\n * Searches dynamically-resolved agent tools (provided via `toolsResolver` /\n * function-based `tools`) for a tool with the given id. Used as a fallback\n * after the static tool registry (`registeredTools` + `mastra.getToolById`)\n * misses, so global tool routes can resolve tools that only exist on agents.\n *\n * Errors thrown by an individual agent's `listTools()` are logged and\n * skipped so a single broken resolver doesn't take down the whole lookup.\n */\nasync function findToolInAgents(mastra: any, toolId: string, requestContext: any): Promise<any | undefined> {\n  const agents = mastra.listAgents() || {};\n  for (const agent of Object.values(agents) as any[]) {\n    try {\n      const agentTools = await agent.listTools({ requestContext });\n      const found = Object.values(agentTools || {}).find((t: any) => t.id === toolId);\n      if (found) return found;\n    } catch (error) {\n      mastra.getLogger?.()?.warn?.('Failed to list tools for agent while resolving tool by id', {\n        agentId: agent?.id,\n        toolId,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  return undefined;\n}\n\n/**\n * Serializes a tool for API responses, handling both regular tools (with Zod schemas)\n * and provider-defined tools (with AI SDK lazy schemas).\n */\nfunction serializeTool(tool: any): any {\n  // Provider-defined tools (e.g. google.tools.googleSearch(), openai.tools.webSearch())\n  // have lazy inputSchema functions that return AI SDK Schema objects, not Zod schemas.\n  // We resolve them and use the jsonSchema property directly.\n  if (isProviderDefinedTool(tool)) {\n    const resolvedInput = resolveLazySchema(tool.inputSchema);\n    const resolvedOutput = resolveLazySchema(tool.outputSchema);\n    return {\n      ...tool,\n      inputSchema:\n        resolvedInput && typeof resolvedInput === 'object' && 'jsonSchema' in resolvedInput\n          ? stringify(resolvedInput.jsonSchema)\n          : undefined,\n      outputSchema:\n        resolvedOutput && typeof resolvedOutput === 'object' && 'jsonSchema' in resolvedOutput\n          ? stringify(resolvedOutput.jsonSchema)\n          : undefined,\n    };\n  }\n\n  return {\n    ...tool,\n    inputSchema: serializeSchema(tool.inputSchema, { stripInjectedOverrides: true }),\n    outputSchema: serializeSchema(tool.outputSchema),\n    requestContextSchema: serializeSchema(tool.requestContextSchema),\n  };\n}\n\n// ============================================================================\n// Route Definitions (new pattern - handlers defined inline with createRoute)\n// ============================================================================\n\nexport const LIST_TOOLS_ROUTE = createRoute({\n  method: 'GET',\n  path: '/tools',\n  responseType: 'json',\n  responseSchema: listToolsResponseSchema,\n  summary: 'List all tools',\n  description: 'Returns a list of all available tools in the system',\n  tags: ['Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, registeredTools, requestContext }) => {\n    try {\n      // Merge tools from two sources: mastra.listTools() includes dynamically created tools\n      // (e.g. MCP tools, or agent tools registered by their intrinsic id), while registeredTools\n      // includes tools discovered by the CLI bundler (keyed by export name).\n      //\n      // The same tool instance can appear in both maps under different keys (e.g. an agent\n      // registers it by `tool.id` while the bundler registers it by export name). Dedupe by\n      // `tool.id`, preferring the registeredTools (bundler) key, so each tool appears once.\n      const registered = registeredTools && Object.keys(registeredTools).length > 0 ? registeredTools : {};\n\n      const allTools: Record<string, any> = {};\n      const seenToolIds = new Map<string, string>();\n\n      // registeredTools first so their key wins for a given tool.id.\n      for (const [key, tool] of Object.entries(registered)) {\n        const toolId = typeof (tool as any)?.id === 'string' ? (tool as any).id : undefined;\n        if (toolId !== undefined) seenToolIds.set(toolId, key);\n        allTools[key] = tool;\n      }\n\n      for (const [key, tool] of Object.entries(mastra.listTools() ?? {})) {\n        const toolId = typeof (tool as any)?.id === 'string' ? (tool as any).id : undefined;\n        // Skip if this exact tool.id was already registered (under any key) by registeredTools.\n        if (toolId !== undefined && seenToolIds.has(toolId)) continue;\n        if (toolId !== undefined) seenToolIds.set(toolId, key);\n        allTools[key] = tool;\n      }\n\n      const serializedTools = Object.entries(allTools).reduce<Record<string, any>>((acc, [id, _tool]) => {\n        acc[id] = serializeTool(_tool);\n        return acc;\n      }, {});\n\n      // Filter tools by FGA if configured\n      const fgaProvider = getHandlerFGAProvider(mastra, requestContext);\n      const user = requestContext?.get('user');\n      if (fgaProvider && user) {\n        const toolList = Object.entries(serializedTools).map(([id, t]) => ({ id, ...t }));\n        const accessible = await fgaProvider.filterAccessible(user, toolList, 'tool', MastraFGAPermissions.TOOLS_READ);\n        const accessibleSet = new Set(accessible.map((t: any) => t.id));\n        for (const id of Object.keys(serializedTools)) {\n          if (!accessibleSet.has(id)) {\n            delete serializedTools[id];\n          }\n        }\n      }\n\n      return serializedTools;\n    } catch (error) {\n      return handleError(error, 'Error getting tools');\n    }\n  },\n});\n\nexport const GET_TOOL_BY_ID_ROUTE = createRoute({\n  method: 'GET',\n  path: '/tools/:toolId',\n  responseType: 'json',\n  pathParamSchema: toolIdPathParams,\n  responseSchema: serializedToolSchema,\n  summary: 'Get tool by ID',\n  description: 'Returns details for a specific tool including its schema and configuration',\n  tags: ['Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, registeredTools, toolId, requestContext }) => {\n    try {\n      let tool: any;\n\n      // Try explicit registeredTools first, then fallback to mastra\n      if (registeredTools && Object.keys(registeredTools).length > 0) {\n        tool = Object.values(registeredTools).find((t: any) => t.id === toolId);\n      }\n      if (!tool) {\n        try {\n          tool = mastra.getToolById(toolId);\n        } catch {\n          // tool not found in global registry, continue to agent fallback\n        }\n      }\n\n      // Fallback: search dynamically-resolved agent tools (toolsResolver)\n      if (!tool) {\n        tool = await findToolInAgents(mastra, toolId, requestContext);\n      }\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      return serializeTool(tool);\n    } catch (error) {\n      return handleError(error, 'Error getting tool');\n    }\n  },\n});\n\nexport const EXECUTE_TOOL_ROUTE = createRoute({\n  method: 'POST',\n  path: '/tools/:toolId/execute',\n  responseType: 'json',\n  pathParamSchema: toolIdPathParams,\n  queryParamSchema: optionalRunIdSchema,\n  bodySchema: executeToolContextBodySchema,\n  responseSchema: executeToolResponseSchema,\n  summary: 'Execute tool',\n  description: 'Executes a specific tool with the provided input data',\n  tags: ['Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, runId, toolId, registeredTools, requestContext, ...bodyParams }) => {\n    try {\n      if (!toolId) {\n        throw new HTTPException(400, { message: 'Tool ID is required' });\n      }\n\n      let tool: any;\n\n      // Try explicit registeredTools first, then fallback to mastra\n      if (registeredTools && Object.keys(registeredTools).length > 0) {\n        tool = Object.values(registeredTools).find((t: any) => t.id === toolId);\n      }\n      if (!tool) {\n        try {\n          tool = mastra.getToolById(toolId);\n        } catch {\n          // tool not found in global registry, continue to agent fallback\n        }\n      }\n\n      // Fallback: search dynamically-resolved agent tools (toolsResolver)\n      if (!tool) {\n        tool = await findToolInAgents(mastra, toolId, requestContext);\n      }\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      if (!tool?.execute) {\n        throw new HTTPException(400, { message: 'Tool is not executable' });\n      }\n\n      const { data } = bodyParams;\n\n      validateBody({ data });\n\n      let result;\n      if (isVercelTool(tool)) {\n        result = await (tool as any).execute(data);\n      } else {\n        result = await tool.execute(data!, {\n          mastra,\n          requestContext,\n          // TODO: Pass proper tracing context when server API supports tracing\n          tracingContext: { currentSpan: undefined },\n          ...(runId\n            ? {\n                workflow: {\n                  runId,\n                  suspend: async () => {},\n                },\n              }\n            : {}),\n        });\n      }\n\n      return result;\n    } catch (error) {\n      return handleError(error, 'Error executing tool');\n    }\n  },\n});\n\n// ============================================================================\n// Agent Tool Routes\n// ============================================================================\n\nexport const GET_AGENT_TOOL_ROUTE = createRoute({\n  method: 'GET',\n  path: '/agents/:agentId/tools/:toolId',\n  responseType: 'json',\n  pathParamSchema: agentToolPathParams,\n  responseSchema: serializedToolSchema,\n  summary: 'Get agent tool',\n  description: 'Returns details for a specific tool assigned to the agent',\n  tags: ['Agents', 'Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, agentId, toolId, requestContext }) => {\n    try {\n      if (!agentId) {\n        throw new HTTPException(400, { message: 'Agent ID is required' });\n      }\n      const agent = await getAgentFromSystem({ mastra, agentId });\n\n      const agentTools = await agent.listTools({ requestContext });\n\n      const tool = Object.values(agentTools || {}).find((tool: any) => tool.id === toolId) as any;\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      return serializeTool(tool);\n    } catch (error) {\n      return handleError(error, 'Error getting agent tool');\n    }\n  },\n});\n\nexport const EXECUTE_AGENT_TOOL_ROUTE = createRoute({\n  method: 'POST',\n  path: '/agents/:agentId/tools/:toolId/execute',\n  responseType: 'json',\n  pathParamSchema: agentToolPathParams,\n  bodySchema: executeToolBodySchema,\n  responseSchema: executeToolResponseSchema,\n  summary: 'Execute agent tool',\n  description: 'Executes a specific tool assigned to the agent with the provided input data',\n  tags: ['Agents', 'Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, agentId, toolId, data, requestContext }) => {\n    try {\n      if (!agentId) {\n        throw new HTTPException(400, { message: 'Agent ID is required' });\n      }\n      const agent = await getAgentFromSystem({ mastra, agentId });\n\n      const agentTools = await agent.listTools({ requestContext });\n\n      const tool = Object.values(agentTools || {}).find((tool: any) => tool.id === toolId) as any;\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      if (!tool?.execute) {\n        throw new HTTPException(400, { message: 'Tool is not executable' });\n      }\n\n      const result = await tool.execute(data, {\n        mastra,\n        requestContext,\n        // TODO: Pass proper tracing context when server API supports tracing\n        tracingContext: { currentSpan: undefined },\n      });\n\n      return result;\n    } catch (error) {\n      return handleError(error, 'Error executing agent tool');\n    }\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,kBAAkB,QAA0B;CACnD,IAAI,OAAO,WAAW,cAAc,EAAE,eAAe,SACnD,OAAO,kBAAkB,OAAO,CAAC;CAEnC,OAAO;AACT;AAEA,SAAS,mBAAmB,QAA2C;CACrE,IAAI,CAAC,QACH;CAGF,OAAO,2BAA2B,iBAAiB,MAAM,GAAG,EAAE,QAAQ,gBAAgB,CAAC;AACzF;AAEA,SAAS,gBAAgB,QAAiB,SAAoE;CAC5G,MAAM,aAAa,mBAAmB,kBAAkB,MAAM,CAAsC;CACpG,IAAI,eAAe,KAAA,GAAW,OAAO,KAAA;CACrC,OAAO,UAAU,SAAS,yBAAyB,gCAAgC,UAAU,IAAI,UAAU;AAC7G;;;;;;;;;;AAWA,eAAe,iBAAiB,QAAa,QAAgB,gBAA+C;CAC1G,MAAM,SAAS,OAAO,WAAW,KAAK,CAAC;CACvC,KAAK,MAAM,SAAS,OAAO,OAAO,MAAM,GACtC,IAAI;EACF,MAAM,aAAa,MAAM,MAAM,UAAU,EAAE,eAAe,CAAC;EAC3D,MAAM,QAAQ,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,MAAW,EAAE,OAAO,MAAM;EAC9E,IAAI,OAAO,OAAO;CACpB,SAAS,OAAO;EACd,OAAO,YAAY,CAAC,EAAE,OAAO,6DAA6D;GACxF,SAAS,OAAO;GAChB;GACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAC9D,CAAC;CACH;AAGJ;;;;;AAMA,SAAS,cAAc,MAAgB;CAIrC,IAAI,sBAAsB,IAAI,GAAG;EAC/B,MAAM,gBAAgB,kBAAkB,KAAK,WAAW;EACxD,MAAM,iBAAiB,kBAAkB,KAAK,YAAY;EAC1D,OAAO;GACL,GAAG;GACH,aACE,iBAAiB,OAAO,kBAAkB,YAAY,gBAAgB,gBAClE,UAAU,cAAc,UAAU,IAClC,KAAA;GACN,cACE,kBAAkB,OAAO,mBAAmB,YAAY,gBAAgB,iBACpE,UAAU,eAAe,UAAU,IACnC,KAAA;EACR;CACF;CAEA,OAAO;EACL,GAAG;EACH,aAAa,gBAAgB,KAAK,aAAa,EAAE,wBAAwB,KAAK,CAAC;EAC/E,cAAc,gBAAgB,KAAK,YAAY;EAC/C,sBAAsB,gBAAgB,KAAK,oBAAoB;CACjE;AACF;AAMA,MAAa,mBAAmB,YAAY;CAC1C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,OAAO;CACd,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,iBAAiB,qBAAqB;EAC9D,IAAI;GAQF,MAAM,aAAa,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,IAAI,kBAAkB,CAAC;GAEnG,MAAM,WAAgC,CAAC;GACvC,MAAM,8BAAc,IAAI,IAAoB;GAG5C,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,UAAU,GAAG;IACpD,MAAM,SAAS,OAAQ,MAAc,OAAO,WAAY,KAAa,KAAK,KAAA;IAC1E,IAAI,WAAW,KAAA,GAAW,YAAY,IAAI,QAAQ,GAAG;IACrD,SAAS,OAAO;GAClB;GAEA,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,OAAO,UAAU,KAAK,CAAC,CAAC,GAAG;IAClE,MAAM,SAAS,OAAQ,MAAc,OAAO,WAAY,KAAa,KAAK,KAAA;IAE1E,IAAI,WAAW,KAAA,KAAa,YAAY,IAAI,MAAM,GAAG;IACrD,IAAI,WAAW,KAAA,GAAW,YAAY,IAAI,QAAQ,GAAG;IACrD,SAAS,OAAO;GAClB;GAEA,MAAM,kBAAkB,OAAO,QAAQ,QAAQ,CAAC,CAAC,QAA6B,KAAK,CAAC,IAAI,WAAW;IACjG,IAAI,MAAM,cAAc,KAAK;IAC7B,OAAO;GACT,GAAG,CAAC,CAAC;GAGL,MAAM,cAAc,sBAAsB,QAAQ,cAAc;GAChE,MAAM,OAAO,gBAAgB,IAAI,MAAM;GACvC,IAAI,eAAe,MAAM;IACvB,MAAM,WAAW,OAAO,QAAQ,eAAe,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ;KAAE;KAAI,GAAG;IAAE,EAAE;IAChF,MAAM,aAAa,MAAM,YAAY,iBAAiB,MAAM,UAAU,QAAQ,qBAAqB,UAAU;IAC7G,MAAM,gBAAgB,IAAI,IAAI,WAAW,KAAK,MAAW,EAAE,EAAE,CAAC;IAC9D,KAAK,MAAM,MAAM,OAAO,KAAK,eAAe,GAC1C,IAAI,CAAC,cAAc,IAAI,EAAE,GACvB,OAAO,gBAAgB;GAG7B;GAEA,OAAO;EACT,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,qBAAqB;EACjD;CACF;AACF,CAAC;AAED,MAAa,uBAAuB,YAAY;CAC9C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,OAAO;CACd,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,iBAAiB,QAAQ,qBAAqB;EACtE,IAAI;GACF,IAAI;GAGJ,IAAI,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,GAC3D,OAAO,OAAO,OAAO,eAAe,CAAC,CAAC,MAAM,MAAW,EAAE,OAAO,MAAM;GAExE,IAAI,CAAC,MACH,IAAI;IACF,OAAO,OAAO,YAAY,MAAM;GAClC,QAAQ,CAER;GAIF,IAAI,CAAC,MACH,OAAO,MAAM,iBAAiB,QAAQ,QAAQ,cAAc;GAG9D,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,OAAO,cAAc,IAAI;EAC3B,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,oBAAoB;EAChD;CACF;AACF,CAAC;AAED,MAAa,qBAAqB,YAAY;CAC5C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,YAAY;CACZ,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,OAAO;CACd,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,OAAO,QAAQ,iBAAiB,gBAAgB,GAAG,iBAAiB;EAC5F,IAAI;GACF,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,sBAAsB,CAAC;GAGjE,IAAI;GAGJ,IAAI,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,GAC3D,OAAO,OAAO,OAAO,eAAe,CAAC,CAAC,MAAM,MAAW,EAAE,OAAO,MAAM;GAExE,IAAI,CAAC,MACH,IAAI;IACF,OAAO,OAAO,YAAY,MAAM;GAClC,QAAQ,CAER;GAIF,IAAI,CAAC,MACH,OAAO,MAAM,iBAAiB,QAAQ,QAAQ,cAAc;GAG9D,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,IAAI,CAAC,MAAM,SACT,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,yBAAyB,CAAC;GAGpE,MAAM,EAAE,SAAS;GAEjB,aAAa,EAAE,KAAK,CAAC;GAErB,IAAI;GACJ,IAAI,aAAa,IAAI,GACnB,SAAS,MAAO,KAAa,QAAQ,IAAI;QAEzC,SAAS,MAAM,KAAK,QAAQ,MAAO;IACjC;IACA;IAEA,gBAAgB,EAAE,aAAa,KAAA,EAAU;IACzC,GAAI,QACA,EACE,UAAU;KACR;KACA,SAAS,YAAY,CAAC;IACxB,EACF,IACA,CAAC;GACP,CAAC;GAGH,OAAO;EACT,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,sBAAsB;EAClD;CACF;AACF,CAAC;AAMD,MAAa,uBAAuB,YAAY;CAC9C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,OAAO;CACxB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,qBAAqB;EAC9D,IAAI;GACF,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,uBAAuB,CAAC;GAIlE,MAAM,aAAa,OAAM,MAFL,mBAAmB;IAAE;IAAQ;GAAQ,CAAC,EAAA,CAE3B,UAAU,EAAE,eAAe,CAAC;GAE3D,MAAM,OAAO,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,SAAc,KAAK,OAAO,MAAM;GAEnF,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,OAAO,cAAc,IAAI;EAC3B,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,0BAA0B;EACtD;CACF;AACF,CAAC;AAED,MAAa,2BAA2B,YAAY;CAClD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,YAAY;CACZ,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,OAAO;CACxB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,MAAM,qBAAqB;EACpE,IAAI;GACF,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,uBAAuB,CAAC;GAIlE,MAAM,aAAa,OAAM,MAFL,mBAAmB;IAAE;IAAQ;GAAQ,CAAC,EAAA,CAE3B,UAAU,EAAE,eAAe,CAAC;GAE3D,MAAM,OAAO,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,SAAc,KAAK,OAAO,MAAM;GAEnF,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,IAAI,CAAC,MAAM,SACT,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,yBAAyB,CAAC;GAUpE,OAAO,MAPc,KAAK,QAAQ,MAAM;IACtC;IACA;IAEA,gBAAgB,EAAE,aAAa,KAAA,EAAU;GAC3C,CAAC;EAGH,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,4BAA4B;EACxD;CACF;AACF,CAAC"}
+{"version":3,"file":"tools-CtELrYsA.js","names":[],"sources":["../src/server/handlers/tools.ts"],"sourcesContent":["import { isVercelTool, isProviderDefinedTool } from '@mastra/core/tools';\nimport { toStandardSchema, standardSchemaToJSONSchema } from '@mastra/schema-compat/schema';\nimport type { PublicSchema } from '@mastra/schema-compat/schema';\nimport { stringify } from 'superjson';\nimport { MastraFGAPermissions } from '../fga-permissions';\nimport { HTTPException } from '../http-exception';\nimport {\n  executeToolContextBodySchema,\n  executeToolResponseSchema,\n  listToolsResponseSchema,\n  serializedToolSchema,\n  toolIdPathParams,\n  agentToolPathParams,\n  executeToolBodySchema,\n} from '../schemas/agents';\nimport { optionalRunIdSchema } from '../schemas/common';\nimport { createRoute } from '../server-adapter/routes/route-builder';\n\nimport { getAgentFromSystem } from './agents';\nimport { handleError } from './error';\nimport { stripInjectedToolOverrideFields } from './tool-schema-overrides';\nimport { getHandlerFGAProvider, validateBody } from './utils';\n\n/**\n * Resolves a schema that may be a lazy function (e.g. AI SDK provider tools).\n * Recursively resolves until a non-function value is returned.\n * Skips functions that are themselves valid schemas (e.g. ArkType types are\n * callable but also implement StandardSchema via ~standard).\n */\nfunction resolveLazySchema(schema: unknown): unknown {\n  if (typeof schema === 'function' && !('~standard' in schema)) {\n    return resolveLazySchema(schema());\n  }\n  return schema;\n}\n\nfunction schemaToJsonSchema(schema: PublicSchema<unknown> | undefined) {\n  if (!schema) {\n    return undefined;\n  }\n\n  return standardSchemaToJSONSchema(toStandardSchema(schema), { target: 'draft-2020-12' });\n}\n\nfunction serializeSchema(schema: unknown, options?: { stripInjectedOverrides?: boolean }): string | undefined {\n  const jsonSchema = schemaToJsonSchema(resolveLazySchema(schema) as PublicSchema<unknown> | undefined);\n  if (jsonSchema === undefined) return undefined;\n  return stringify(options?.stripInjectedOverrides ? stripInjectedToolOverrideFields(jsonSchema) : jsonSchema);\n}\n\n/**\n * Searches dynamically-resolved agent tools (provided via `toolsResolver` /\n * function-based `tools`) for a tool with the given id. Used as a fallback\n * after the static tool registry (`registeredTools` + `mastra.getToolById`)\n * misses, so global tool routes can resolve tools that only exist on agents.\n *\n * Errors thrown by an individual agent's `listTools()` are logged and\n * skipped so a single broken resolver doesn't take down the whole lookup.\n */\nasync function findToolInAgents(mastra: any, toolId: string, requestContext: any): Promise<any | undefined> {\n  const agents = mastra.listAgents() || {};\n  for (const agent of Object.values(agents) as any[]) {\n    try {\n      const agentTools = await agent.listTools({ requestContext });\n      const found = Object.values(agentTools || {}).find((t: any) => t.id === toolId);\n      if (found) return found;\n    } catch (error) {\n      mastra.getLogger?.()?.warn?.('Failed to list tools for agent while resolving tool by id', {\n        agentId: agent?.id,\n        toolId,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  return undefined;\n}\n\n/**\n * Serializes a tool for API responses, handling both regular tools (with Zod schemas)\n * and provider-defined tools (with AI SDK lazy schemas).\n */\nfunction serializeTool(tool: any): any {\n  // Provider-defined tools (e.g. google.tools.googleSearch(), openai.tools.webSearch())\n  // have lazy inputSchema functions that return AI SDK Schema objects, not Zod schemas.\n  // We resolve them and use the jsonSchema property directly.\n  if (isProviderDefinedTool(tool)) {\n    const resolvedInput = resolveLazySchema(tool.inputSchema);\n    const resolvedOutput = resolveLazySchema(tool.outputSchema);\n    return {\n      ...tool,\n      inputSchema:\n        resolvedInput && typeof resolvedInput === 'object' && 'jsonSchema' in resolvedInput\n          ? stringify(resolvedInput.jsonSchema)\n          : undefined,\n      outputSchema:\n        resolvedOutput && typeof resolvedOutput === 'object' && 'jsonSchema' in resolvedOutput\n          ? stringify(resolvedOutput.jsonSchema)\n          : undefined,\n    };\n  }\n\n  return {\n    ...tool,\n    inputSchema: serializeSchema(tool.inputSchema, { stripInjectedOverrides: true }),\n    outputSchema: serializeSchema(tool.outputSchema),\n    requestContextSchema: serializeSchema(tool.requestContextSchema),\n  };\n}\n\n// ============================================================================\n// Route Definitions (new pattern - handlers defined inline with createRoute)\n// ============================================================================\n\nexport const LIST_TOOLS_ROUTE = createRoute({\n  method: 'GET',\n  path: '/tools',\n  responseType: 'json',\n  responseSchema: listToolsResponseSchema,\n  summary: 'List all tools',\n  description: 'Returns a list of all available tools in the system',\n  tags: ['Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, registeredTools, requestContext }) => {\n    try {\n      // Merge tools from two sources: mastra.listTools() includes dynamically created tools\n      // (e.g. MCP tools, or agent tools registered by their intrinsic id), while registeredTools\n      // includes tools discovered by the CLI bundler (keyed by export name).\n      //\n      // The same tool instance can appear in both maps under different keys (e.g. an agent\n      // registers it by `tool.id` while the bundler registers it by export name). Dedupe by\n      // `tool.id`, preferring the registeredTools (bundler) key, so each tool appears once.\n      const registered = registeredTools && Object.keys(registeredTools).length > 0 ? registeredTools : {};\n\n      const allTools: Record<string, any> = {};\n      const seenToolIds = new Map<string, string>();\n\n      // registeredTools first so their key wins for a given tool.id.\n      for (const [key, tool] of Object.entries(registered)) {\n        const toolId = typeof (tool as any)?.id === 'string' ? (tool as any).id : undefined;\n        if (toolId !== undefined) seenToolIds.set(toolId, key);\n        allTools[key] = tool;\n      }\n\n      for (const [key, tool] of Object.entries(mastra.listTools() ?? {})) {\n        const toolId = typeof (tool as any)?.id === 'string' ? (tool as any).id : undefined;\n        // Skip if this exact tool.id was already registered (under any key) by registeredTools.\n        if (toolId !== undefined && seenToolIds.has(toolId)) continue;\n        if (toolId !== undefined) seenToolIds.set(toolId, key);\n        allTools[key] = tool;\n      }\n\n      const serializedTools = Object.entries(allTools).reduce<Record<string, any>>((acc, [id, _tool]) => {\n        acc[id] = serializeTool(_tool);\n        return acc;\n      }, {});\n\n      // Filter tools by FGA if configured\n      const fgaProvider = getHandlerFGAProvider(mastra, requestContext);\n      const user = requestContext?.get('user');\n      if (fgaProvider && user) {\n        const toolList = Object.entries(serializedTools).map(([id, t]) => ({ id, ...t }));\n        const accessible = await fgaProvider.filterAccessible(user, toolList, 'tool', MastraFGAPermissions.TOOLS_READ);\n        const accessibleSet = new Set(accessible.map((t: any) => t.id));\n        for (const id of Object.keys(serializedTools)) {\n          if (!accessibleSet.has(id)) {\n            delete serializedTools[id];\n          }\n        }\n      }\n\n      return serializedTools;\n    } catch (error) {\n      return handleError(error, 'Error getting tools');\n    }\n  },\n});\n\nexport const GET_TOOL_BY_ID_ROUTE = createRoute({\n  method: 'GET',\n  path: '/tools/:toolId',\n  responseType: 'json',\n  pathParamSchema: toolIdPathParams,\n  responseSchema: serializedToolSchema,\n  summary: 'Get tool by ID',\n  description: 'Returns details for a specific tool including its schema and configuration',\n  tags: ['Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, registeredTools, toolId, requestContext }) => {\n    try {\n      let tool: any;\n\n      // Try explicit registeredTools first, then fallback to mastra\n      if (registeredTools && Object.keys(registeredTools).length > 0) {\n        tool = Object.values(registeredTools).find((t: any) => t.id === toolId);\n      }\n      if (!tool) {\n        try {\n          tool = mastra.getToolById(toolId);\n        } catch {\n          // tool not found in global registry, continue to agent fallback\n        }\n      }\n\n      // Fallback: search dynamically-resolved agent tools (toolsResolver)\n      if (!tool) {\n        tool = await findToolInAgents(mastra, toolId, requestContext);\n      }\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      return serializeTool(tool);\n    } catch (error) {\n      return handleError(error, 'Error getting tool');\n    }\n  },\n});\n\nexport const EXECUTE_TOOL_ROUTE = createRoute({\n  method: 'POST',\n  path: '/tools/:toolId/execute',\n  responseType: 'json',\n  pathParamSchema: toolIdPathParams,\n  queryParamSchema: optionalRunIdSchema,\n  bodySchema: executeToolContextBodySchema,\n  responseSchema: executeToolResponseSchema,\n  summary: 'Execute tool',\n  description: 'Executes a specific tool with the provided input data',\n  tags: ['Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, runId, toolId, registeredTools, requestContext, ...bodyParams }) => {\n    try {\n      if (!toolId) {\n        throw new HTTPException(400, { message: 'Tool ID is required' });\n      }\n\n      let tool: any;\n\n      // Try explicit registeredTools first, then fallback to mastra\n      if (registeredTools && Object.keys(registeredTools).length > 0) {\n        tool = Object.values(registeredTools).find((t: any) => t.id === toolId);\n      }\n      if (!tool) {\n        try {\n          tool = mastra.getToolById(toolId);\n        } catch {\n          // tool not found in global registry, continue to agent fallback\n        }\n      }\n\n      // Fallback: search dynamically-resolved agent tools (toolsResolver)\n      if (!tool) {\n        tool = await findToolInAgents(mastra, toolId, requestContext);\n      }\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      if (!tool?.execute) {\n        throw new HTTPException(400, { message: 'Tool is not executable' });\n      }\n\n      const { data } = bodyParams;\n\n      validateBody({ data });\n\n      let result;\n      if (isVercelTool(tool)) {\n        result = await (tool as any).execute(data);\n      } else {\n        result = await tool.execute(data!, {\n          mastra,\n          requestContext,\n          // TODO: Pass proper tracing context when server API supports tracing\n          tracingContext: { currentSpan: undefined },\n          ...(runId\n            ? {\n                workflow: {\n                  runId,\n                  suspend: async () => {},\n                },\n              }\n            : {}),\n        });\n      }\n\n      return result;\n    } catch (error) {\n      return handleError(error, 'Error executing tool');\n    }\n  },\n});\n\n// ============================================================================\n// Agent Tool Routes\n// ============================================================================\n\nexport const GET_AGENT_TOOL_ROUTE = createRoute({\n  method: 'GET',\n  path: '/agents/:agentId/tools/:toolId',\n  responseType: 'json',\n  pathParamSchema: agentToolPathParams,\n  responseSchema: serializedToolSchema,\n  summary: 'Get agent tool',\n  description: 'Returns details for a specific tool assigned to the agent',\n  tags: ['Agents', 'Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, agentId, toolId, requestContext }) => {\n    try {\n      if (!agentId) {\n        throw new HTTPException(400, { message: 'Agent ID is required' });\n      }\n      const agent = await getAgentFromSystem({ mastra, agentId });\n\n      const agentTools = await agent.listTools({ requestContext });\n\n      const tool = Object.values(agentTools || {}).find((tool: any) => tool.id === toolId) as any;\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      return serializeTool(tool);\n    } catch (error) {\n      return handleError(error, 'Error getting agent tool');\n    }\n  },\n});\n\nexport const EXECUTE_AGENT_TOOL_ROUTE = createRoute({\n  method: 'POST',\n  path: '/agents/:agentId/tools/:toolId/execute',\n  responseType: 'json',\n  pathParamSchema: agentToolPathParams,\n  bodySchema: executeToolBodySchema,\n  responseSchema: executeToolResponseSchema,\n  summary: 'Execute agent tool',\n  description: 'Executes a specific tool assigned to the agent with the provided input data',\n  tags: ['Agents', 'Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, agentId, toolId, data, requestContext }) => {\n    try {\n      if (!agentId) {\n        throw new HTTPException(400, { message: 'Agent ID is required' });\n      }\n      const agent = await getAgentFromSystem({ mastra, agentId });\n\n      const agentTools = await agent.listTools({ requestContext });\n\n      const tool = Object.values(agentTools || {}).find((tool: any) => tool.id === toolId) as any;\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      if (!tool?.execute) {\n        throw new HTTPException(400, { message: 'Tool is not executable' });\n      }\n\n      const result = await tool.execute(data, {\n        mastra,\n        requestContext,\n        // TODO: Pass proper tracing context when server API supports tracing\n        tracingContext: { currentSpan: undefined },\n      });\n\n      return result;\n    } catch (error) {\n      return handleError(error, 'Error executing agent tool');\n    }\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,kBAAkB,QAA0B;CACnD,IAAI,OAAO,WAAW,cAAc,EAAE,eAAe,SACnD,OAAO,kBAAkB,OAAO,CAAC;CAEnC,OAAO;AACT;AAEA,SAAS,mBAAmB,QAA2C;CACrE,IAAI,CAAC,QACH;CAGF,OAAO,2BAA2B,iBAAiB,MAAM,GAAG,EAAE,QAAQ,gBAAgB,CAAC;AACzF;AAEA,SAAS,gBAAgB,QAAiB,SAAoE;CAC5G,MAAM,aAAa,mBAAmB,kBAAkB,MAAM,CAAsC;CACpG,IAAI,eAAe,KAAA,GAAW,OAAO,KAAA;CACrC,OAAO,UAAU,SAAS,yBAAyB,gCAAgC,UAAU,IAAI,UAAU;AAC7G;;;;;;;;;;AAWA,eAAe,iBAAiB,QAAa,QAAgB,gBAA+C;CAC1G,MAAM,SAAS,OAAO,WAAW,KAAK,CAAC;CACvC,KAAK,MAAM,SAAS,OAAO,OAAO,MAAM,GACtC,IAAI;EACF,MAAM,aAAa,MAAM,MAAM,UAAU,EAAE,eAAe,CAAC;EAC3D,MAAM,QAAQ,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,MAAW,EAAE,OAAO,MAAM;EAC9E,IAAI,OAAO,OAAO;CACpB,SAAS,OAAO;EACd,OAAO,YAAY,CAAC,EAAE,OAAO,6DAA6D;GACxF,SAAS,OAAO;GAChB;GACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAC9D,CAAC;CACH;AAGJ;;;;;AAMA,SAAS,cAAc,MAAgB;CAIrC,IAAI,sBAAsB,IAAI,GAAG;EAC/B,MAAM,gBAAgB,kBAAkB,KAAK,WAAW;EACxD,MAAM,iBAAiB,kBAAkB,KAAK,YAAY;EAC1D,OAAO;GACL,GAAG;GACH,aACE,iBAAiB,OAAO,kBAAkB,YAAY,gBAAgB,gBAClE,UAAU,cAAc,UAAU,IAClC,KAAA;GACN,cACE,kBAAkB,OAAO,mBAAmB,YAAY,gBAAgB,iBACpE,UAAU,eAAe,UAAU,IACnC,KAAA;EACR;CACF;CAEA,OAAO;EACL,GAAG;EACH,aAAa,gBAAgB,KAAK,aAAa,EAAE,wBAAwB,KAAK,CAAC;EAC/E,cAAc,gBAAgB,KAAK,YAAY;EAC/C,sBAAsB,gBAAgB,KAAK,oBAAoB;CACjE;AACF;AAMA,MAAa,mBAAmB,YAAY;CAC1C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,OAAO;CACd,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,iBAAiB,qBAAqB;EAC9D,IAAI;GAQF,MAAM,aAAa,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,IAAI,kBAAkB,CAAC;GAEnG,MAAM,WAAgC,CAAC;GACvC,MAAM,8BAAc,IAAI,IAAoB;GAG5C,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,UAAU,GAAG;IACpD,MAAM,SAAS,OAAQ,MAAc,OAAO,WAAY,KAAa,KAAK,KAAA;IAC1E,IAAI,WAAW,KAAA,GAAW,YAAY,IAAI,QAAQ,GAAG;IACrD,SAAS,OAAO;GAClB;GAEA,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,OAAO,UAAU,KAAK,CAAC,CAAC,GAAG;IAClE,MAAM,SAAS,OAAQ,MAAc,OAAO,WAAY,KAAa,KAAK,KAAA;IAE1E,IAAI,WAAW,KAAA,KAAa,YAAY,IAAI,MAAM,GAAG;IACrD,IAAI,WAAW,KAAA,GAAW,YAAY,IAAI,QAAQ,GAAG;IACrD,SAAS,OAAO;GAClB;GAEA,MAAM,kBAAkB,OAAO,QAAQ,QAAQ,CAAC,CAAC,QAA6B,KAAK,CAAC,IAAI,WAAW;IACjG,IAAI,MAAM,cAAc,KAAK;IAC7B,OAAO;GACT,GAAG,CAAC,CAAC;GAGL,MAAM,cAAc,sBAAsB,QAAQ,cAAc;GAChE,MAAM,OAAO,gBAAgB,IAAI,MAAM;GACvC,IAAI,eAAe,MAAM;IACvB,MAAM,WAAW,OAAO,QAAQ,eAAe,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ;KAAE;KAAI,GAAG;IAAE,EAAE;IAChF,MAAM,aAAa,MAAM,YAAY,iBAAiB,MAAM,UAAU,QAAQ,qBAAqB,UAAU;IAC7G,MAAM,gBAAgB,IAAI,IAAI,WAAW,KAAK,MAAW,EAAE,EAAE,CAAC;IAC9D,KAAK,MAAM,MAAM,OAAO,KAAK,eAAe,GAC1C,IAAI,CAAC,cAAc,IAAI,EAAE,GACvB,OAAO,gBAAgB;GAG7B;GAEA,OAAO;EACT,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,qBAAqB;EACjD;CACF;AACF,CAAC;AAED,MAAa,uBAAuB,YAAY;CAC9C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,OAAO;CACd,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,iBAAiB,QAAQ,qBAAqB;EACtE,IAAI;GACF,IAAI;GAGJ,IAAI,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,GAC3D,OAAO,OAAO,OAAO,eAAe,CAAC,CAAC,MAAM,MAAW,EAAE,OAAO,MAAM;GAExE,IAAI,CAAC,MACH,IAAI;IACF,OAAO,OAAO,YAAY,MAAM;GAClC,QAAQ,CAER;GAIF,IAAI,CAAC,MACH,OAAO,MAAM,iBAAiB,QAAQ,QAAQ,cAAc;GAG9D,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,OAAO,cAAc,IAAI;EAC3B,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,oBAAoB;EAChD;CACF;AACF,CAAC;AAED,MAAa,qBAAqB,YAAY;CAC5C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,YAAY;CACZ,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,OAAO;CACd,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,OAAO,QAAQ,iBAAiB,gBAAgB,GAAG,iBAAiB;EAC5F,IAAI;GACF,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,sBAAsB,CAAC;GAGjE,IAAI;GAGJ,IAAI,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,GAC3D,OAAO,OAAO,OAAO,eAAe,CAAC,CAAC,MAAM,MAAW,EAAE,OAAO,MAAM;GAExE,IAAI,CAAC,MACH,IAAI;IACF,OAAO,OAAO,YAAY,MAAM;GAClC,QAAQ,CAER;GAIF,IAAI,CAAC,MACH,OAAO,MAAM,iBAAiB,QAAQ,QAAQ,cAAc;GAG9D,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,IAAI,CAAC,MAAM,SACT,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,yBAAyB,CAAC;GAGpE,MAAM,EAAE,SAAS;GAEjB,aAAa,EAAE,KAAK,CAAC;GAErB,IAAI;GACJ,IAAI,aAAa,IAAI,GACnB,SAAS,MAAO,KAAa,QAAQ,IAAI;QAEzC,SAAS,MAAM,KAAK,QAAQ,MAAO;IACjC;IACA;IAEA,gBAAgB,EAAE,aAAa,KAAA,EAAU;IACzC,GAAI,QACA,EACE,UAAU;KACR;KACA,SAAS,YAAY,CAAC;IACxB,EACF,IACA,CAAC;GACP,CAAC;GAGH,OAAO;EACT,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,sBAAsB;EAClD;CACF;AACF,CAAC;AAMD,MAAa,uBAAuB,YAAY;CAC9C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,OAAO;CACxB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,qBAAqB;EAC9D,IAAI;GACF,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,uBAAuB,CAAC;GAIlE,MAAM,aAAa,OAAM,MAFL,mBAAmB;IAAE;IAAQ;GAAQ,CAAC,EAAA,CAE3B,UAAU,EAAE,eAAe,CAAC;GAE3D,MAAM,OAAO,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,SAAc,KAAK,OAAO,MAAM;GAEnF,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,OAAO,cAAc,IAAI;EAC3B,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,0BAA0B;EACtD;CACF;AACF,CAAC;AAED,MAAa,2BAA2B,YAAY;CAClD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,YAAY;CACZ,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,OAAO;CACxB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,MAAM,qBAAqB;EACpE,IAAI;GACF,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,uBAAuB,CAAC;GAIlE,MAAM,aAAa,OAAM,MAFL,mBAAmB;IAAE;IAAQ;GAAQ,CAAC,EAAA,CAE3B,UAAU,EAAE,eAAe,CAAC;GAE3D,MAAM,OAAO,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,SAAc,KAAK,OAAO,MAAM;GAEnF,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,IAAI,CAAC,MAAM,SACT,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,yBAAyB,CAAC;GAUpE,OAAO,MAPc,KAAK,QAAQ,MAAM;IACtC;IACA;IAEA,gBAAgB,EAAE,aAAa,KAAA,EAAU;GAC3C,CAAC;EAGH,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,4BAA4B;EACxD;CACF;AACF,CAAC"}

package/dist/{tools-Dy_j6URC.cjs → tools-DtRHH9Hr.cjs}

@@ -4,10 +4,10 @@ const require_common = require("./common-D5XxSuvu.cjs");
 const require_agents = require("./agents-Cel1sffU.cjs");
 const require_schema_Bf12g7KC = require("./schema-Bf12g7KC-plP4Ir6h.cjs");
 const require_route_builder = require("./route-builder-CvARmqnA.cjs");
-const require_utils = require("./utils-BnH77wPf.cjs");
+const require_utils = require("./utils-bQ6Jhog6.cjs");
 const require_server_handlers_error = require("./server/handlers/error.cjs");
-const require_utils$1 = require("./utils-BbYUI6Yn.cjs");
-const require_agents$1 = require("./agents-BjdRPzyV.cjs");
+const require_utils$1 = require("./utils-9PRHHTGC.cjs");
+const require_agents$1 = require("./agents-SvkxJW48.cjs");
 const require_server_handlers_tool_schema_overrides = require("./server/handlers/tool-schema-overrides.cjs");
 let _mastra_core_tools = require("@mastra/core/tools");
 // src/server/handlers/tools.ts
@@ -287,4 +287,4 @@ Object.defineProperty(exports, "tools_exports", {
 	}
 });
 
-//# sourceMappingURL=tools-Dy_j6URC.cjs.map
+//# sourceMappingURL=tools-DtRHH9Hr.cjs.map

package/dist/{tools-Dy_j6URC.cjs.map → tools-DtRHH9Hr.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"tools-Dy_j6URC.cjs","names":["standardSchemaToJSONSchema","toStandardSchema","stringify","stripInjectedToolOverrideFields","isProviderDefinedTool","createRoute","listToolsResponseSchema","getHandlerFGAProvider","MastraFGAPermissions","handleError","toolIdPathParams","serializedToolSchema","HTTPException","optionalRunIdSchema","executeToolContextBodySchema","executeToolResponseSchema","isVercelTool","agentToolPathParams","getAgentFromSystem","executeToolBodySchema"],"sources":["../src/server/handlers/tools.ts"],"sourcesContent":["import { isVercelTool, isProviderDefinedTool } from '@mastra/core/tools';\nimport { toStandardSchema, standardSchemaToJSONSchema } from '@mastra/schema-compat/schema';\nimport type { PublicSchema } from '@mastra/schema-compat/schema';\nimport { stringify } from 'superjson';\nimport { MastraFGAPermissions } from '../fga-permissions';\nimport { HTTPException } from '../http-exception';\nimport {\n  executeToolContextBodySchema,\n  executeToolResponseSchema,\n  listToolsResponseSchema,\n  serializedToolSchema,\n  toolIdPathParams,\n  agentToolPathParams,\n  executeToolBodySchema,\n} from '../schemas/agents';\nimport { optionalRunIdSchema } from '../schemas/common';\nimport { createRoute } from '../server-adapter/routes/route-builder';\n\nimport { getAgentFromSystem } from './agents';\nimport { handleError } from './error';\nimport { stripInjectedToolOverrideFields } from './tool-schema-overrides';\nimport { getHandlerFGAProvider, validateBody } from './utils';\n\n/**\n * Resolves a schema that may be a lazy function (e.g. AI SDK provider tools).\n * Recursively resolves until a non-function value is returned.\n * Skips functions that are themselves valid schemas (e.g. ArkType types are\n * callable but also implement StandardSchema via ~standard).\n */\nfunction resolveLazySchema(schema: unknown): unknown {\n  if (typeof schema === 'function' && !('~standard' in schema)) {\n    return resolveLazySchema(schema());\n  }\n  return schema;\n}\n\nfunction schemaToJsonSchema(schema: PublicSchema<unknown> | undefined) {\n  if (!schema) {\n    return undefined;\n  }\n\n  return standardSchemaToJSONSchema(toStandardSchema(schema), { target: 'draft-2020-12' });\n}\n\nfunction serializeSchema(schema: unknown, options?: { stripInjectedOverrides?: boolean }): string | undefined {\n  const jsonSchema = schemaToJsonSchema(resolveLazySchema(schema) as PublicSchema<unknown> | undefined);\n  if (jsonSchema === undefined) return undefined;\n  return stringify(options?.stripInjectedOverrides ? stripInjectedToolOverrideFields(jsonSchema) : jsonSchema);\n}\n\n/**\n * Searches dynamically-resolved agent tools (provided via `toolsResolver` /\n * function-based `tools`) for a tool with the given id. Used as a fallback\n * after the static tool registry (`registeredTools` + `mastra.getToolById`)\n * misses, so global tool routes can resolve tools that only exist on agents.\n *\n * Errors thrown by an individual agent's `listTools()` are logged and\n * skipped so a single broken resolver doesn't take down the whole lookup.\n */\nasync function findToolInAgents(mastra: any, toolId: string, requestContext: any): Promise<any | undefined> {\n  const agents = mastra.listAgents() || {};\n  for (const agent of Object.values(agents) as any[]) {\n    try {\n      const agentTools = await agent.listTools({ requestContext });\n      const found = Object.values(agentTools || {}).find((t: any) => t.id === toolId);\n      if (found) return found;\n    } catch (error) {\n      mastra.getLogger?.()?.warn?.('Failed to list tools for agent while resolving tool by id', {\n        agentId: agent?.id,\n        toolId,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  return undefined;\n}\n\n/**\n * Serializes a tool for API responses, handling both regular tools (with Zod schemas)\n * and provider-defined tools (with AI SDK lazy schemas).\n */\nfunction serializeTool(tool: any): any {\n  // Provider-defined tools (e.g. google.tools.googleSearch(), openai.tools.webSearch())\n  // have lazy inputSchema functions that return AI SDK Schema objects, not Zod schemas.\n  // We resolve them and use the jsonSchema property directly.\n  if (isProviderDefinedTool(tool)) {\n    const resolvedInput = resolveLazySchema(tool.inputSchema);\n    const resolvedOutput = resolveLazySchema(tool.outputSchema);\n    return {\n      ...tool,\n      inputSchema:\n        resolvedInput && typeof resolvedInput === 'object' && 'jsonSchema' in resolvedInput\n          ? stringify(resolvedInput.jsonSchema)\n          : undefined,\n      outputSchema:\n        resolvedOutput && typeof resolvedOutput === 'object' && 'jsonSchema' in resolvedOutput\n          ? stringify(resolvedOutput.jsonSchema)\n          : undefined,\n    };\n  }\n\n  return {\n    ...tool,\n    inputSchema: serializeSchema(tool.inputSchema, { stripInjectedOverrides: true }),\n    outputSchema: serializeSchema(tool.outputSchema),\n    requestContextSchema: serializeSchema(tool.requestContextSchema),\n  };\n}\n\n// ============================================================================\n// Route Definitions (new pattern - handlers defined inline with createRoute)\n// ============================================================================\n\nexport const LIST_TOOLS_ROUTE = createRoute({\n  method: 'GET',\n  path: '/tools',\n  responseType: 'json',\n  responseSchema: listToolsResponseSchema,\n  summary: 'List all tools',\n  description: 'Returns a list of all available tools in the system',\n  tags: ['Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, registeredTools, requestContext }) => {\n    try {\n      // Merge tools from two sources: mastra.listTools() includes dynamically created tools\n      // (e.g. MCP tools, or agent tools registered by their intrinsic id), while registeredTools\n      // includes tools discovered by the CLI bundler (keyed by export name).\n      //\n      // The same tool instance can appear in both maps under different keys (e.g. an agent\n      // registers it by `tool.id` while the bundler registers it by export name). Dedupe by\n      // `tool.id`, preferring the registeredTools (bundler) key, so each tool appears once.\n      const registered = registeredTools && Object.keys(registeredTools).length > 0 ? registeredTools : {};\n\n      const allTools: Record<string, any> = {};\n      const seenToolIds = new Map<string, string>();\n\n      // registeredTools first so their key wins for a given tool.id.\n      for (const [key, tool] of Object.entries(registered)) {\n        const toolId = typeof (tool as any)?.id === 'string' ? (tool as any).id : undefined;\n        if (toolId !== undefined) seenToolIds.set(toolId, key);\n        allTools[key] = tool;\n      }\n\n      for (const [key, tool] of Object.entries(mastra.listTools() ?? {})) {\n        const toolId = typeof (tool as any)?.id === 'string' ? (tool as any).id : undefined;\n        // Skip if this exact tool.id was already registered (under any key) by registeredTools.\n        if (toolId !== undefined && seenToolIds.has(toolId)) continue;\n        if (toolId !== undefined) seenToolIds.set(toolId, key);\n        allTools[key] = tool;\n      }\n\n      const serializedTools = Object.entries(allTools).reduce<Record<string, any>>((acc, [id, _tool]) => {\n        acc[id] = serializeTool(_tool);\n        return acc;\n      }, {});\n\n      // Filter tools by FGA if configured\n      const fgaProvider = getHandlerFGAProvider(mastra, requestContext);\n      const user = requestContext?.get('user');\n      if (fgaProvider && user) {\n        const toolList = Object.entries(serializedTools).map(([id, t]) => ({ id, ...t }));\n        const accessible = await fgaProvider.filterAccessible(user, toolList, 'tool', MastraFGAPermissions.TOOLS_READ);\n        const accessibleSet = new Set(accessible.map((t: any) => t.id));\n        for (const id of Object.keys(serializedTools)) {\n          if (!accessibleSet.has(id)) {\n            delete serializedTools[id];\n          }\n        }\n      }\n\n      return serializedTools;\n    } catch (error) {\n      return handleError(error, 'Error getting tools');\n    }\n  },\n});\n\nexport const GET_TOOL_BY_ID_ROUTE = createRoute({\n  method: 'GET',\n  path: '/tools/:toolId',\n  responseType: 'json',\n  pathParamSchema: toolIdPathParams,\n  responseSchema: serializedToolSchema,\n  summary: 'Get tool by ID',\n  description: 'Returns details for a specific tool including its schema and configuration',\n  tags: ['Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, registeredTools, toolId, requestContext }) => {\n    try {\n      let tool: any;\n\n      // Try explicit registeredTools first, then fallback to mastra\n      if (registeredTools && Object.keys(registeredTools).length > 0) {\n        tool = Object.values(registeredTools).find((t: any) => t.id === toolId);\n      }\n      if (!tool) {\n        try {\n          tool = mastra.getToolById(toolId);\n        } catch {\n          // tool not found in global registry, continue to agent fallback\n        }\n      }\n\n      // Fallback: search dynamically-resolved agent tools (toolsResolver)\n      if (!tool) {\n        tool = await findToolInAgents(mastra, toolId, requestContext);\n      }\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      return serializeTool(tool);\n    } catch (error) {\n      return handleError(error, 'Error getting tool');\n    }\n  },\n});\n\nexport const EXECUTE_TOOL_ROUTE = createRoute({\n  method: 'POST',\n  path: '/tools/:toolId/execute',\n  responseType: 'json',\n  pathParamSchema: toolIdPathParams,\n  queryParamSchema: optionalRunIdSchema,\n  bodySchema: executeToolContextBodySchema,\n  responseSchema: executeToolResponseSchema,\n  summary: 'Execute tool',\n  description: 'Executes a specific tool with the provided input data',\n  tags: ['Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, runId, toolId, registeredTools, requestContext, ...bodyParams }) => {\n    try {\n      if (!toolId) {\n        throw new HTTPException(400, { message: 'Tool ID is required' });\n      }\n\n      let tool: any;\n\n      // Try explicit registeredTools first, then fallback to mastra\n      if (registeredTools && Object.keys(registeredTools).length > 0) {\n        tool = Object.values(registeredTools).find((t: any) => t.id === toolId);\n      }\n      if (!tool) {\n        try {\n          tool = mastra.getToolById(toolId);\n        } catch {\n          // tool not found in global registry, continue to agent fallback\n        }\n      }\n\n      // Fallback: search dynamically-resolved agent tools (toolsResolver)\n      if (!tool) {\n        tool = await findToolInAgents(mastra, toolId, requestContext);\n      }\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      if (!tool?.execute) {\n        throw new HTTPException(400, { message: 'Tool is not executable' });\n      }\n\n      const { data } = bodyParams;\n\n      validateBody({ data });\n\n      let result;\n      if (isVercelTool(tool)) {\n        result = await (tool as any).execute(data);\n      } else {\n        result = await tool.execute(data!, {\n          mastra,\n          requestContext,\n          // TODO: Pass proper tracing context when server API supports tracing\n          tracingContext: { currentSpan: undefined },\n          ...(runId\n            ? {\n                workflow: {\n                  runId,\n                  suspend: async () => {},\n                },\n              }\n            : {}),\n        });\n      }\n\n      return result;\n    } catch (error) {\n      return handleError(error, 'Error executing tool');\n    }\n  },\n});\n\n// ============================================================================\n// Agent Tool Routes\n// ============================================================================\n\nexport const GET_AGENT_TOOL_ROUTE = createRoute({\n  method: 'GET',\n  path: '/agents/:agentId/tools/:toolId',\n  responseType: 'json',\n  pathParamSchema: agentToolPathParams,\n  responseSchema: serializedToolSchema,\n  summary: 'Get agent tool',\n  description: 'Returns details for a specific tool assigned to the agent',\n  tags: ['Agents', 'Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, agentId, toolId, requestContext }) => {\n    try {\n      if (!agentId) {\n        throw new HTTPException(400, { message: 'Agent ID is required' });\n      }\n      const agent = await getAgentFromSystem({ mastra, agentId });\n\n      const agentTools = await agent.listTools({ requestContext });\n\n      const tool = Object.values(agentTools || {}).find((tool: any) => tool.id === toolId) as any;\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      return serializeTool(tool);\n    } catch (error) {\n      return handleError(error, 'Error getting agent tool');\n    }\n  },\n});\n\nexport const EXECUTE_AGENT_TOOL_ROUTE = createRoute({\n  method: 'POST',\n  path: '/agents/:agentId/tools/:toolId/execute',\n  responseType: 'json',\n  pathParamSchema: agentToolPathParams,\n  bodySchema: executeToolBodySchema,\n  responseSchema: executeToolResponseSchema,\n  summary: 'Execute agent tool',\n  description: 'Executes a specific tool assigned to the agent with the provided input data',\n  tags: ['Agents', 'Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, agentId, toolId, data, requestContext }) => {\n    try {\n      if (!agentId) {\n        throw new HTTPException(400, { message: 'Agent ID is required' });\n      }\n      const agent = await getAgentFromSystem({ mastra, agentId });\n\n      const agentTools = await agent.listTools({ requestContext });\n\n      const tool = Object.values(agentTools || {}).find((tool: any) => tool.id === toolId) as any;\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      if (!tool?.execute) {\n        throw new HTTPException(400, { message: 'Tool is not executable' });\n      }\n\n      const result = await tool.execute(data, {\n        mastra,\n        requestContext,\n        // TODO: Pass proper tracing context when server API supports tracing\n        tracingContext: { currentSpan: undefined },\n      });\n\n      return result;\n    } catch (error) {\n      return handleError(error, 'Error executing agent tool');\n    }\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,kBAAkB,QAA0B;CACnD,IAAI,OAAO,WAAW,cAAc,EAAE,eAAe,SACnD,OAAO,kBAAkB,OAAO,CAAC;CAEnC,OAAO;AACT;AAEA,SAAS,mBAAmB,QAA2C;CACrE,IAAI,CAAC,QACH;CAGF,OAAOA,wBAAAA,2BAA2BC,wBAAAA,iBAAiB,MAAM,GAAG,EAAE,QAAQ,gBAAgB,CAAC;AACzF;AAEA,SAAS,gBAAgB,QAAiB,SAAoE;CAC5G,MAAM,aAAa,mBAAmB,kBAAkB,MAAM,CAAsC;CACpG,IAAI,eAAe,KAAA,GAAW,OAAO,KAAA;CACrC,OAAOC,cAAAA,UAAU,SAAS,yBAAyBC,8CAAAA,gCAAgC,UAAU,IAAI,UAAU;AAC7G;;;;;;;;;;AAWA,eAAe,iBAAiB,QAAa,QAAgB,gBAA+C;CAC1G,MAAM,SAAS,OAAO,WAAW,KAAK,CAAC;CACvC,KAAK,MAAM,SAAS,OAAO,OAAO,MAAM,GACtC,IAAI;EACF,MAAM,aAAa,MAAM,MAAM,UAAU,EAAE,eAAe,CAAC;EAC3D,MAAM,QAAQ,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,MAAW,EAAE,OAAO,MAAM;EAC9E,IAAI,OAAO,OAAO;CACpB,SAAS,OAAO;EACd,OAAO,YAAY,CAAC,EAAE,OAAO,6DAA6D;GACxF,SAAS,OAAO;GAChB;GACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAC9D,CAAC;CACH;AAGJ;;;;;AAMA,SAAS,cAAc,MAAgB;CAIrC,KAAA,GAAIC,mBAAAA,sBAAAA,CAAsB,IAAI,GAAG;EAC/B,MAAM,gBAAgB,kBAAkB,KAAK,WAAW;EACxD,MAAM,iBAAiB,kBAAkB,KAAK,YAAY;EAC1D,OAAO;GACL,GAAG;GACH,aACE,iBAAiB,OAAO,kBAAkB,YAAY,gBAAgB,gBAClEF,cAAAA,UAAU,cAAc,UAAU,IAClC,KAAA;GACN,cACE,kBAAkB,OAAO,mBAAmB,YAAY,gBAAgB,iBACpEA,cAAAA,UAAU,eAAe,UAAU,IACnC,KAAA;EACR;CACF;CAEA,OAAO;EACL,GAAG;EACH,aAAa,gBAAgB,KAAK,aAAa,EAAE,wBAAwB,KAAK,CAAC;EAC/E,cAAc,gBAAgB,KAAK,YAAY;EAC/C,sBAAsB,gBAAgB,KAAK,oBAAoB;CACjE;AACF;AAMA,MAAa,mBAAmBG,sBAAAA,YAAY;CAC1C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,gBAAgBC,eAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,OAAO;CACd,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,iBAAiB,qBAAqB;EAC9D,IAAI;GAQF,MAAM,aAAa,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,IAAI,kBAAkB,CAAC;GAEnG,MAAM,WAAgC,CAAC;GACvC,MAAM,8BAAc,IAAI,IAAoB;GAG5C,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,UAAU,GAAG;IACpD,MAAM,SAAS,OAAQ,MAAc,OAAO,WAAY,KAAa,KAAK,KAAA;IAC1E,IAAI,WAAW,KAAA,GAAW,YAAY,IAAI,QAAQ,GAAG;IACrD,SAAS,OAAO;GAClB;GAEA,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,OAAO,UAAU,KAAK,CAAC,CAAC,GAAG;IAClE,MAAM,SAAS,OAAQ,MAAc,OAAO,WAAY,KAAa,KAAK,KAAA;IAE1E,IAAI,WAAW,KAAA,KAAa,YAAY,IAAI,MAAM,GAAG;IACrD,IAAI,WAAW,KAAA,GAAW,YAAY,IAAI,QAAQ,GAAG;IACrD,SAAS,OAAO;GAClB;GAEA,MAAM,kBAAkB,OAAO,QAAQ,QAAQ,CAAC,CAAC,QAA6B,KAAK,CAAC,IAAI,WAAW;IACjG,IAAI,MAAM,cAAc,KAAK;IAC7B,OAAO;GACT,GAAG,CAAC,CAAC;GAGL,MAAM,cAAcC,gBAAAA,sBAAsB,QAAQ,cAAc;GAChE,MAAM,OAAO,gBAAgB,IAAI,MAAM;GACvC,IAAI,eAAe,MAAM;IACvB,MAAM,WAAW,OAAO,QAAQ,eAAe,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ;KAAE;KAAI,GAAG;IAAE,EAAE;IAChF,MAAM,aAAa,MAAM,YAAY,iBAAiB,MAAM,UAAU,QAAQC,gBAAAA,qBAAqB,UAAU;IAC7G,MAAM,gBAAgB,IAAI,IAAI,WAAW,KAAK,MAAW,EAAE,EAAE,CAAC;IAC9D,KAAK,MAAM,MAAM,OAAO,KAAK,eAAe,GAC1C,IAAI,CAAC,cAAc,IAAI,EAAE,GACvB,OAAO,gBAAgB;GAG7B;GAEA,OAAO;EACT,SAAS,OAAO;GACd,OAAOC,8BAAAA,YAAY,OAAO,qBAAqB;EACjD;CACF;AACF,CAAC;AAED,MAAa,uBAAuBJ,sBAAAA,YAAY;CAC9C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBK,eAAAA;CACjB,gBAAgBC,eAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,OAAO;CACd,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,iBAAiB,QAAQ,qBAAqB;EACtE,IAAI;GACF,IAAI;GAGJ,IAAI,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,GAC3D,OAAO,OAAO,OAAO,eAAe,CAAC,CAAC,MAAM,MAAW,EAAE,OAAO,MAAM;GAExE,IAAI,CAAC,MACH,IAAI;IACF,OAAO,OAAO,YAAY,MAAM;GAClC,QAAQ,CAER;GAIF,IAAI,CAAC,MACH,OAAO,MAAM,iBAAiB,QAAQ,QAAQ,cAAc;GAG9D,IAAI,CAAC,MACH,MAAM,IAAIC,uBAAAA,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,OAAO,cAAc,IAAI;EAC3B,SAAS,OAAO;GACd,OAAOH,8BAAAA,YAAY,OAAO,oBAAoB;EAChD;CACF;AACF,CAAC;AAED,MAAa,qBAAqBJ,sBAAAA,YAAY;CAC5C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBK,eAAAA;CACjB,kBAAkBG,eAAAA;CAClB,YAAYC,eAAAA;CACZ,gBAAgBC,eAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,OAAO;CACd,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,OAAO,QAAQ,iBAAiB,gBAAgB,GAAG,iBAAiB;EAC5F,IAAI;GACF,IAAI,CAAC,QACH,MAAM,IAAIH,uBAAAA,cAAc,KAAK,EAAE,SAAS,sBAAsB,CAAC;GAGjE,IAAI;GAGJ,IAAI,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,GAC3D,OAAO,OAAO,OAAO,eAAe,CAAC,CAAC,MAAM,MAAW,EAAE,OAAO,MAAM;GAExE,IAAI,CAAC,MACH,IAAI;IACF,OAAO,OAAO,YAAY,MAAM;GAClC,QAAQ,CAER;GAIF,IAAI,CAAC,MACH,OAAO,MAAM,iBAAiB,QAAQ,QAAQ,cAAc;GAG9D,IAAI,CAAC,MACH,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,IAAI,CAAC,MAAM,SACT,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,yBAAyB,CAAC;GAGpE,MAAM,EAAE,SAAS;GAEjB,gBAAA,aAAa,EAAE,KAAK,CAAC;GAErB,IAAI;GACJ,KAAA,GAAII,mBAAAA,aAAAA,CAAa,IAAI,GACnB,SAAS,MAAO,KAAa,QAAQ,IAAI;QAEzC,SAAS,MAAM,KAAK,QAAQ,MAAO;IACjC;IACA;IAEA,gBAAgB,EAAE,aAAa,KAAA,EAAU;IACzC,GAAI,QACA,EACE,UAAU;KACR;KACA,SAAS,YAAY,CAAC;IACxB,EACF,IACA,CAAC;GACP,CAAC;GAGH,OAAO;EACT,SAAS,OAAO;GACd,OAAOP,8BAAAA,YAAY,OAAO,sBAAsB;EAClD;CACF;AACF,CAAC;AAMD,MAAa,uBAAuBJ,sBAAAA,YAAY;CAC9C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBY,eAAAA;CACjB,gBAAgBN,eAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,OAAO;CACxB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,qBAAqB;EAC9D,IAAI;GACF,IAAI,CAAC,SACH,MAAM,IAAIC,uBAAAA,cAAc,KAAK,EAAE,SAAS,uBAAuB,CAAC;GAIlE,MAAM,aAAa,OAAM,MAFLM,iBAAAA,mBAAmB;IAAE;IAAQ;GAAQ,CAAC,EAAA,CAE3B,UAAU,EAAE,eAAe,CAAC;GAE3D,MAAM,OAAO,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,SAAc,KAAK,OAAO,MAAM;GAEnF,IAAI,CAAC,MACH,MAAM,IAAIN,uBAAAA,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,OAAO,cAAc,IAAI;EAC3B,SAAS,OAAO;GACd,OAAOH,8BAAAA,YAAY,OAAO,0BAA0B;EACtD;CACF;AACF,CAAC;AAED,MAAa,2BAA2BJ,sBAAAA,YAAY;CAClD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBY,eAAAA;CACjB,YAAYE,eAAAA;CACZ,gBAAgBJ,eAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,OAAO;CACxB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,MAAM,qBAAqB;EACpE,IAAI;GACF,IAAI,CAAC,SACH,MAAM,IAAIH,uBAAAA,cAAc,KAAK,EAAE,SAAS,uBAAuB,CAAC;GAIlE,MAAM,aAAa,OAAM,MAFLM,iBAAAA,mBAAmB;IAAE;IAAQ;GAAQ,CAAC,EAAA,CAE3B,UAAU,EAAE,eAAe,CAAC;GAE3D,MAAM,OAAO,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,SAAc,KAAK,OAAO,MAAM;GAEnF,IAAI,CAAC,MACH,MAAM,IAAIN,uBAAAA,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,IAAI,CAAC,MAAM,SACT,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,yBAAyB,CAAC;GAUpE,OAAO,MAPc,KAAK,QAAQ,MAAM;IACtC;IACA;IAEA,gBAAgB,EAAE,aAAa,KAAA,EAAU;GAC3C,CAAC;EAGH,SAAS,OAAO;GACd,OAAOH,8BAAAA,YAAY,OAAO,4BAA4B;EACxD;CACF;AACF,CAAC"}
+{"version":3,"file":"tools-DtRHH9Hr.cjs","names":["standardSchemaToJSONSchema","toStandardSchema","stringify","stripInjectedToolOverrideFields","isProviderDefinedTool","createRoute","listToolsResponseSchema","getHandlerFGAProvider","MastraFGAPermissions","handleError","toolIdPathParams","serializedToolSchema","HTTPException","optionalRunIdSchema","executeToolContextBodySchema","executeToolResponseSchema","isVercelTool","agentToolPathParams","getAgentFromSystem","executeToolBodySchema"],"sources":["../src/server/handlers/tools.ts"],"sourcesContent":["import { isVercelTool, isProviderDefinedTool } from '@mastra/core/tools';\nimport { toStandardSchema, standardSchemaToJSONSchema } from '@mastra/schema-compat/schema';\nimport type { PublicSchema } from '@mastra/schema-compat/schema';\nimport { stringify } from 'superjson';\nimport { MastraFGAPermissions } from '../fga-permissions';\nimport { HTTPException } from '../http-exception';\nimport {\n  executeToolContextBodySchema,\n  executeToolResponseSchema,\n  listToolsResponseSchema,\n  serializedToolSchema,\n  toolIdPathParams,\n  agentToolPathParams,\n  executeToolBodySchema,\n} from '../schemas/agents';\nimport { optionalRunIdSchema } from '../schemas/common';\nimport { createRoute } from '../server-adapter/routes/route-builder';\n\nimport { getAgentFromSystem } from './agents';\nimport { handleError } from './error';\nimport { stripInjectedToolOverrideFields } from './tool-schema-overrides';\nimport { getHandlerFGAProvider, validateBody } from './utils';\n\n/**\n * Resolves a schema that may be a lazy function (e.g. AI SDK provider tools).\n * Recursively resolves until a non-function value is returned.\n * Skips functions that are themselves valid schemas (e.g. ArkType types are\n * callable but also implement StandardSchema via ~standard).\n */\nfunction resolveLazySchema(schema: unknown): unknown {\n  if (typeof schema === 'function' && !('~standard' in schema)) {\n    return resolveLazySchema(schema());\n  }\n  return schema;\n}\n\nfunction schemaToJsonSchema(schema: PublicSchema<unknown> | undefined) {\n  if (!schema) {\n    return undefined;\n  }\n\n  return standardSchemaToJSONSchema(toStandardSchema(schema), { target: 'draft-2020-12' });\n}\n\nfunction serializeSchema(schema: unknown, options?: { stripInjectedOverrides?: boolean }): string | undefined {\n  const jsonSchema = schemaToJsonSchema(resolveLazySchema(schema) as PublicSchema<unknown> | undefined);\n  if (jsonSchema === undefined) return undefined;\n  return stringify(options?.stripInjectedOverrides ? stripInjectedToolOverrideFields(jsonSchema) : jsonSchema);\n}\n\n/**\n * Searches dynamically-resolved agent tools (provided via `toolsResolver` /\n * function-based `tools`) for a tool with the given id. Used as a fallback\n * after the static tool registry (`registeredTools` + `mastra.getToolById`)\n * misses, so global tool routes can resolve tools that only exist on agents.\n *\n * Errors thrown by an individual agent's `listTools()` are logged and\n * skipped so a single broken resolver doesn't take down the whole lookup.\n */\nasync function findToolInAgents(mastra: any, toolId: string, requestContext: any): Promise<any | undefined> {\n  const agents = mastra.listAgents() || {};\n  for (const agent of Object.values(agents) as any[]) {\n    try {\n      const agentTools = await agent.listTools({ requestContext });\n      const found = Object.values(agentTools || {}).find((t: any) => t.id === toolId);\n      if (found) return found;\n    } catch (error) {\n      mastra.getLogger?.()?.warn?.('Failed to list tools for agent while resolving tool by id', {\n        agentId: agent?.id,\n        toolId,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  return undefined;\n}\n\n/**\n * Serializes a tool for API responses, handling both regular tools (with Zod schemas)\n * and provider-defined tools (with AI SDK lazy schemas).\n */\nfunction serializeTool(tool: any): any {\n  // Provider-defined tools (e.g. google.tools.googleSearch(), openai.tools.webSearch())\n  // have lazy inputSchema functions that return AI SDK Schema objects, not Zod schemas.\n  // We resolve them and use the jsonSchema property directly.\n  if (isProviderDefinedTool(tool)) {\n    const resolvedInput = resolveLazySchema(tool.inputSchema);\n    const resolvedOutput = resolveLazySchema(tool.outputSchema);\n    return {\n      ...tool,\n      inputSchema:\n        resolvedInput && typeof resolvedInput === 'object' && 'jsonSchema' in resolvedInput\n          ? stringify(resolvedInput.jsonSchema)\n          : undefined,\n      outputSchema:\n        resolvedOutput && typeof resolvedOutput === 'object' && 'jsonSchema' in resolvedOutput\n          ? stringify(resolvedOutput.jsonSchema)\n          : undefined,\n    };\n  }\n\n  return {\n    ...tool,\n    inputSchema: serializeSchema(tool.inputSchema, { stripInjectedOverrides: true }),\n    outputSchema: serializeSchema(tool.outputSchema),\n    requestContextSchema: serializeSchema(tool.requestContextSchema),\n  };\n}\n\n// ============================================================================\n// Route Definitions (new pattern - handlers defined inline with createRoute)\n// ============================================================================\n\nexport const LIST_TOOLS_ROUTE = createRoute({\n  method: 'GET',\n  path: '/tools',\n  responseType: 'json',\n  responseSchema: listToolsResponseSchema,\n  summary: 'List all tools',\n  description: 'Returns a list of all available tools in the system',\n  tags: ['Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, registeredTools, requestContext }) => {\n    try {\n      // Merge tools from two sources: mastra.listTools() includes dynamically created tools\n      // (e.g. MCP tools, or agent tools registered by their intrinsic id), while registeredTools\n      // includes tools discovered by the CLI bundler (keyed by export name).\n      //\n      // The same tool instance can appear in both maps under different keys (e.g. an agent\n      // registers it by `tool.id` while the bundler registers it by export name). Dedupe by\n      // `tool.id`, preferring the registeredTools (bundler) key, so each tool appears once.\n      const registered = registeredTools && Object.keys(registeredTools).length > 0 ? registeredTools : {};\n\n      const allTools: Record<string, any> = {};\n      const seenToolIds = new Map<string, string>();\n\n      // registeredTools first so their key wins for a given tool.id.\n      for (const [key, tool] of Object.entries(registered)) {\n        const toolId = typeof (tool as any)?.id === 'string' ? (tool as any).id : undefined;\n        if (toolId !== undefined) seenToolIds.set(toolId, key);\n        allTools[key] = tool;\n      }\n\n      for (const [key, tool] of Object.entries(mastra.listTools() ?? {})) {\n        const toolId = typeof (tool as any)?.id === 'string' ? (tool as any).id : undefined;\n        // Skip if this exact tool.id was already registered (under any key) by registeredTools.\n        if (toolId !== undefined && seenToolIds.has(toolId)) continue;\n        if (toolId !== undefined) seenToolIds.set(toolId, key);\n        allTools[key] = tool;\n      }\n\n      const serializedTools = Object.entries(allTools).reduce<Record<string, any>>((acc, [id, _tool]) => {\n        acc[id] = serializeTool(_tool);\n        return acc;\n      }, {});\n\n      // Filter tools by FGA if configured\n      const fgaProvider = getHandlerFGAProvider(mastra, requestContext);\n      const user = requestContext?.get('user');\n      if (fgaProvider && user) {\n        const toolList = Object.entries(serializedTools).map(([id, t]) => ({ id, ...t }));\n        const accessible = await fgaProvider.filterAccessible(user, toolList, 'tool', MastraFGAPermissions.TOOLS_READ);\n        const accessibleSet = new Set(accessible.map((t: any) => t.id));\n        for (const id of Object.keys(serializedTools)) {\n          if (!accessibleSet.has(id)) {\n            delete serializedTools[id];\n          }\n        }\n      }\n\n      return serializedTools;\n    } catch (error) {\n      return handleError(error, 'Error getting tools');\n    }\n  },\n});\n\nexport const GET_TOOL_BY_ID_ROUTE = createRoute({\n  method: 'GET',\n  path: '/tools/:toolId',\n  responseType: 'json',\n  pathParamSchema: toolIdPathParams,\n  responseSchema: serializedToolSchema,\n  summary: 'Get tool by ID',\n  description: 'Returns details for a specific tool including its schema and configuration',\n  tags: ['Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, registeredTools, toolId, requestContext }) => {\n    try {\n      let tool: any;\n\n      // Try explicit registeredTools first, then fallback to mastra\n      if (registeredTools && Object.keys(registeredTools).length > 0) {\n        tool = Object.values(registeredTools).find((t: any) => t.id === toolId);\n      }\n      if (!tool) {\n        try {\n          tool = mastra.getToolById(toolId);\n        } catch {\n          // tool not found in global registry, continue to agent fallback\n        }\n      }\n\n      // Fallback: search dynamically-resolved agent tools (toolsResolver)\n      if (!tool) {\n        tool = await findToolInAgents(mastra, toolId, requestContext);\n      }\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      return serializeTool(tool);\n    } catch (error) {\n      return handleError(error, 'Error getting tool');\n    }\n  },\n});\n\nexport const EXECUTE_TOOL_ROUTE = createRoute({\n  method: 'POST',\n  path: '/tools/:toolId/execute',\n  responseType: 'json',\n  pathParamSchema: toolIdPathParams,\n  queryParamSchema: optionalRunIdSchema,\n  bodySchema: executeToolContextBodySchema,\n  responseSchema: executeToolResponseSchema,\n  summary: 'Execute tool',\n  description: 'Executes a specific tool with the provided input data',\n  tags: ['Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, runId, toolId, registeredTools, requestContext, ...bodyParams }) => {\n    try {\n      if (!toolId) {\n        throw new HTTPException(400, { message: 'Tool ID is required' });\n      }\n\n      let tool: any;\n\n      // Try explicit registeredTools first, then fallback to mastra\n      if (registeredTools && Object.keys(registeredTools).length > 0) {\n        tool = Object.values(registeredTools).find((t: any) => t.id === toolId);\n      }\n      if (!tool) {\n        try {\n          tool = mastra.getToolById(toolId);\n        } catch {\n          // tool not found in global registry, continue to agent fallback\n        }\n      }\n\n      // Fallback: search dynamically-resolved agent tools (toolsResolver)\n      if (!tool) {\n        tool = await findToolInAgents(mastra, toolId, requestContext);\n      }\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      if (!tool?.execute) {\n        throw new HTTPException(400, { message: 'Tool is not executable' });\n      }\n\n      const { data } = bodyParams;\n\n      validateBody({ data });\n\n      let result;\n      if (isVercelTool(tool)) {\n        result = await (tool as any).execute(data);\n      } else {\n        result = await tool.execute(data!, {\n          mastra,\n          requestContext,\n          // TODO: Pass proper tracing context when server API supports tracing\n          tracingContext: { currentSpan: undefined },\n          ...(runId\n            ? {\n                workflow: {\n                  runId,\n                  suspend: async () => {},\n                },\n              }\n            : {}),\n        });\n      }\n\n      return result;\n    } catch (error) {\n      return handleError(error, 'Error executing tool');\n    }\n  },\n});\n\n// ============================================================================\n// Agent Tool Routes\n// ============================================================================\n\nexport const GET_AGENT_TOOL_ROUTE = createRoute({\n  method: 'GET',\n  path: '/agents/:agentId/tools/:toolId',\n  responseType: 'json',\n  pathParamSchema: agentToolPathParams,\n  responseSchema: serializedToolSchema,\n  summary: 'Get agent tool',\n  description: 'Returns details for a specific tool assigned to the agent',\n  tags: ['Agents', 'Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, agentId, toolId, requestContext }) => {\n    try {\n      if (!agentId) {\n        throw new HTTPException(400, { message: 'Agent ID is required' });\n      }\n      const agent = await getAgentFromSystem({ mastra, agentId });\n\n      const agentTools = await agent.listTools({ requestContext });\n\n      const tool = Object.values(agentTools || {}).find((tool: any) => tool.id === toolId) as any;\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      return serializeTool(tool);\n    } catch (error) {\n      return handleError(error, 'Error getting agent tool');\n    }\n  },\n});\n\nexport const EXECUTE_AGENT_TOOL_ROUTE = createRoute({\n  method: 'POST',\n  path: '/agents/:agentId/tools/:toolId/execute',\n  responseType: 'json',\n  pathParamSchema: agentToolPathParams,\n  bodySchema: executeToolBodySchema,\n  responseSchema: executeToolResponseSchema,\n  summary: 'Execute agent tool',\n  description: 'Executes a specific tool assigned to the agent with the provided input data',\n  tags: ['Agents', 'Tools'],\n  requiresAuth: true,\n  handler: async ({ mastra, agentId, toolId, data, requestContext }) => {\n    try {\n      if (!agentId) {\n        throw new HTTPException(400, { message: 'Agent ID is required' });\n      }\n      const agent = await getAgentFromSystem({ mastra, agentId });\n\n      const agentTools = await agent.listTools({ requestContext });\n\n      const tool = Object.values(agentTools || {}).find((tool: any) => tool.id === toolId) as any;\n\n      if (!tool) {\n        throw new HTTPException(404, { message: 'Tool not found' });\n      }\n\n      if (!tool?.execute) {\n        throw new HTTPException(400, { message: 'Tool is not executable' });\n      }\n\n      const result = await tool.execute(data, {\n        mastra,\n        requestContext,\n        // TODO: Pass proper tracing context when server API supports tracing\n        tracingContext: { currentSpan: undefined },\n      });\n\n      return result;\n    } catch (error) {\n      return handleError(error, 'Error executing agent tool');\n    }\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,kBAAkB,QAA0B;CACnD,IAAI,OAAO,WAAW,cAAc,EAAE,eAAe,SACnD,OAAO,kBAAkB,OAAO,CAAC;CAEnC,OAAO;AACT;AAEA,SAAS,mBAAmB,QAA2C;CACrE,IAAI,CAAC,QACH;CAGF,OAAOA,wBAAAA,2BAA2BC,wBAAAA,iBAAiB,MAAM,GAAG,EAAE,QAAQ,gBAAgB,CAAC;AACzF;AAEA,SAAS,gBAAgB,QAAiB,SAAoE;CAC5G,MAAM,aAAa,mBAAmB,kBAAkB,MAAM,CAAsC;CACpG,IAAI,eAAe,KAAA,GAAW,OAAO,KAAA;CACrC,OAAOC,cAAAA,UAAU,SAAS,yBAAyBC,8CAAAA,gCAAgC,UAAU,IAAI,UAAU;AAC7G;;;;;;;;;;AAWA,eAAe,iBAAiB,QAAa,QAAgB,gBAA+C;CAC1G,MAAM,SAAS,OAAO,WAAW,KAAK,CAAC;CACvC,KAAK,MAAM,SAAS,OAAO,OAAO,MAAM,GACtC,IAAI;EACF,MAAM,aAAa,MAAM,MAAM,UAAU,EAAE,eAAe,CAAC;EAC3D,MAAM,QAAQ,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,MAAW,EAAE,OAAO,MAAM;EAC9E,IAAI,OAAO,OAAO;CACpB,SAAS,OAAO;EACd,OAAO,YAAY,CAAC,EAAE,OAAO,6DAA6D;GACxF,SAAS,OAAO;GAChB;GACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAC9D,CAAC;CACH;AAGJ;;;;;AAMA,SAAS,cAAc,MAAgB;CAIrC,KAAA,GAAIC,mBAAAA,sBAAAA,CAAsB,IAAI,GAAG;EAC/B,MAAM,gBAAgB,kBAAkB,KAAK,WAAW;EACxD,MAAM,iBAAiB,kBAAkB,KAAK,YAAY;EAC1D,OAAO;GACL,GAAG;GACH,aACE,iBAAiB,OAAO,kBAAkB,YAAY,gBAAgB,gBAClEF,cAAAA,UAAU,cAAc,UAAU,IAClC,KAAA;GACN,cACE,kBAAkB,OAAO,mBAAmB,YAAY,gBAAgB,iBACpEA,cAAAA,UAAU,eAAe,UAAU,IACnC,KAAA;EACR;CACF;CAEA,OAAO;EACL,GAAG;EACH,aAAa,gBAAgB,KAAK,aAAa,EAAE,wBAAwB,KAAK,CAAC;EAC/E,cAAc,gBAAgB,KAAK,YAAY;EAC/C,sBAAsB,gBAAgB,KAAK,oBAAoB;CACjE;AACF;AAMA,MAAa,mBAAmBG,sBAAAA,YAAY;CAC1C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,gBAAgBC,eAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,OAAO;CACd,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,iBAAiB,qBAAqB;EAC9D,IAAI;GAQF,MAAM,aAAa,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,IAAI,kBAAkB,CAAC;GAEnG,MAAM,WAAgC,CAAC;GACvC,MAAM,8BAAc,IAAI,IAAoB;GAG5C,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,UAAU,GAAG;IACpD,MAAM,SAAS,OAAQ,MAAc,OAAO,WAAY,KAAa,KAAK,KAAA;IAC1E,IAAI,WAAW,KAAA,GAAW,YAAY,IAAI,QAAQ,GAAG;IACrD,SAAS,OAAO;GAClB;GAEA,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,OAAO,UAAU,KAAK,CAAC,CAAC,GAAG;IAClE,MAAM,SAAS,OAAQ,MAAc,OAAO,WAAY,KAAa,KAAK,KAAA;IAE1E,IAAI,WAAW,KAAA,KAAa,YAAY,IAAI,MAAM,GAAG;IACrD,IAAI,WAAW,KAAA,GAAW,YAAY,IAAI,QAAQ,GAAG;IACrD,SAAS,OAAO;GAClB;GAEA,MAAM,kBAAkB,OAAO,QAAQ,QAAQ,CAAC,CAAC,QAA6B,KAAK,CAAC,IAAI,WAAW;IACjG,IAAI,MAAM,cAAc,KAAK;IAC7B,OAAO;GACT,GAAG,CAAC,CAAC;GAGL,MAAM,cAAcC,gBAAAA,sBAAsB,QAAQ,cAAc;GAChE,MAAM,OAAO,gBAAgB,IAAI,MAAM;GACvC,IAAI,eAAe,MAAM;IACvB,MAAM,WAAW,OAAO,QAAQ,eAAe,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ;KAAE;KAAI,GAAG;IAAE,EAAE;IAChF,MAAM,aAAa,MAAM,YAAY,iBAAiB,MAAM,UAAU,QAAQC,gBAAAA,qBAAqB,UAAU;IAC7G,MAAM,gBAAgB,IAAI,IAAI,WAAW,KAAK,MAAW,EAAE,EAAE,CAAC;IAC9D,KAAK,MAAM,MAAM,OAAO,KAAK,eAAe,GAC1C,IAAI,CAAC,cAAc,IAAI,EAAE,GACvB,OAAO,gBAAgB;GAG7B;GAEA,OAAO;EACT,SAAS,OAAO;GACd,OAAOC,8BAAAA,YAAY,OAAO,qBAAqB;EACjD;CACF;AACF,CAAC;AAED,MAAa,uBAAuBJ,sBAAAA,YAAY;CAC9C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBK,eAAAA;CACjB,gBAAgBC,eAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,OAAO;CACd,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,iBAAiB,QAAQ,qBAAqB;EACtE,IAAI;GACF,IAAI;GAGJ,IAAI,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,GAC3D,OAAO,OAAO,OAAO,eAAe,CAAC,CAAC,MAAM,MAAW,EAAE,OAAO,MAAM;GAExE,IAAI,CAAC,MACH,IAAI;IACF,OAAO,OAAO,YAAY,MAAM;GAClC,QAAQ,CAER;GAIF,IAAI,CAAC,MACH,OAAO,MAAM,iBAAiB,QAAQ,QAAQ,cAAc;GAG9D,IAAI,CAAC,MACH,MAAM,IAAIC,uBAAAA,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,OAAO,cAAc,IAAI;EAC3B,SAAS,OAAO;GACd,OAAOH,8BAAAA,YAAY,OAAO,oBAAoB;EAChD;CACF;AACF,CAAC;AAED,MAAa,qBAAqBJ,sBAAAA,YAAY;CAC5C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBK,eAAAA;CACjB,kBAAkBG,eAAAA;CAClB,YAAYC,eAAAA;CACZ,gBAAgBC,eAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,OAAO;CACd,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,OAAO,QAAQ,iBAAiB,gBAAgB,GAAG,iBAAiB;EAC5F,IAAI;GACF,IAAI,CAAC,QACH,MAAM,IAAIH,uBAAAA,cAAc,KAAK,EAAE,SAAS,sBAAsB,CAAC;GAGjE,IAAI;GAGJ,IAAI,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,GAC3D,OAAO,OAAO,OAAO,eAAe,CAAC,CAAC,MAAM,MAAW,EAAE,OAAO,MAAM;GAExE,IAAI,CAAC,MACH,IAAI;IACF,OAAO,OAAO,YAAY,MAAM;GAClC,QAAQ,CAER;GAIF,IAAI,CAAC,MACH,OAAO,MAAM,iBAAiB,QAAQ,QAAQ,cAAc;GAG9D,IAAI,CAAC,MACH,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,IAAI,CAAC,MAAM,SACT,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,yBAAyB,CAAC;GAGpE,MAAM,EAAE,SAAS;GAEjB,gBAAA,aAAa,EAAE,KAAK,CAAC;GAErB,IAAI;GACJ,KAAA,GAAII,mBAAAA,aAAAA,CAAa,IAAI,GACnB,SAAS,MAAO,KAAa,QAAQ,IAAI;QAEzC,SAAS,MAAM,KAAK,QAAQ,MAAO;IACjC;IACA;IAEA,gBAAgB,EAAE,aAAa,KAAA,EAAU;IACzC,GAAI,QACA,EACE,UAAU;KACR;KACA,SAAS,YAAY,CAAC;IACxB,EACF,IACA,CAAC;GACP,CAAC;GAGH,OAAO;EACT,SAAS,OAAO;GACd,OAAOP,8BAAAA,YAAY,OAAO,sBAAsB;EAClD;CACF;AACF,CAAC;AAMD,MAAa,uBAAuBJ,sBAAAA,YAAY;CAC9C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBY,eAAAA;CACjB,gBAAgBN,eAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,OAAO;CACxB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,qBAAqB;EAC9D,IAAI;GACF,IAAI,CAAC,SACH,MAAM,IAAIC,uBAAAA,cAAc,KAAK,EAAE,SAAS,uBAAuB,CAAC;GAIlE,MAAM,aAAa,OAAM,MAFLM,iBAAAA,mBAAmB;IAAE;IAAQ;GAAQ,CAAC,EAAA,CAE3B,UAAU,EAAE,eAAe,CAAC;GAE3D,MAAM,OAAO,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,SAAc,KAAK,OAAO,MAAM;GAEnF,IAAI,CAAC,MACH,MAAM,IAAIN,uBAAAA,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,OAAO,cAAc,IAAI;EAC3B,SAAS,OAAO;GACd,OAAOH,8BAAAA,YAAY,OAAO,0BAA0B;EACtD;CACF;AACF,CAAC;AAED,MAAa,2BAA2BJ,sBAAAA,YAAY;CAClD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBY,eAAAA;CACjB,YAAYE,eAAAA;CACZ,gBAAgBJ,eAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,UAAU,OAAO;CACxB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,MAAM,qBAAqB;EACpE,IAAI;GACF,IAAI,CAAC,SACH,MAAM,IAAIH,uBAAAA,cAAc,KAAK,EAAE,SAAS,uBAAuB,CAAC;GAIlE,MAAM,aAAa,OAAM,MAFLM,iBAAAA,mBAAmB;IAAE;IAAQ;GAAQ,CAAC,EAAA,CAE3B,UAAU,EAAE,eAAe,CAAC;GAE3D,MAAM,OAAO,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,SAAc,KAAK,OAAO,MAAM;GAEnF,IAAI,CAAC,MACH,MAAM,IAAIN,uBAAAA,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,IAAI,CAAC,MAAM,SACT,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,yBAAyB,CAAC;GAUpE,OAAO,MAPc,KAAK,QAAQ,MAAM;IACtC;IACA;IAEA,gBAAgB,EAAE,aAAa,KAAA,EAAU;GAC3C,CAAC;EAGH,SAAS,OAAO;GACd,OAAOH,8BAAAA,YAAY,OAAO,4BAA4B;EACxD;CACF;AACF,CAAC"}

package/dist/{utils-BbYUI6Yn.cjs → utils-9PRHHTGC.cjs}

@@ -1,6 +1,6 @@
 const require_rolldown_runtime = require("./rolldown-runtime-10nMEhjP.cjs");
 const require_http_exception = require("./http-exception-Co3MbFUf.cjs");
-const require_constants = require("./constants-Co1XjPjd.cjs");
+const require_constants = require("./constants-DMg8hUOR.cjs");
 let _mastra_core_auth_ee = require("@mastra/core/auth/ee");
 _mastra_core_auth_ee = require_rolldown_runtime.__toESM(_mastra_core_auth_ee, 1);
 let _mastra_core_memory = require("@mastra/core/memory");
@@ -39,6 +39,7 @@ const FALLBACK_PERMISSIONS = {
 	AGENTS_DELETE: "agents:delete",
 	AGENTS_EXECUTE: "agents:execute",
 	AGENTS_READ: "agents:read",
+	KNOWLEDGE_READ: "knowledge:read",
 	MEMORY_DELETE: "memory:delete",
 	MEMORY_READ: "memory:read",
 	MEMORY_WRITE: "memory:write",
@@ -50,7 +51,10 @@ const FALLBACK_PERMISSIONS = {
 	WORKFLOWS_READ: "workflows:read"
 };
 const realPermissions = _mastra_core_auth_ee.MastraFGAPermissions;
-const MastraFGAPermissions = realPermissions && Object.keys(realPermissions).length > 0 ? realPermissions : FALLBACK_PERMISSIONS;
+const MastraFGAPermissions = {
+	...FALLBACK_PERMISSIONS,
+	...realPermissions ?? {}
+};
 // src/server/handlers/utils.ts
 /**
 * Resolves a workflow by id or registration key from the set Mastra exposes
@@ -350,4 +354,4 @@ Object.defineProperty(exports, "validateThreadOwnership", {
 	}
 });
 
-//# sourceMappingURL=utils-BbYUI6Yn.cjs.map
+//# sourceMappingURL=utils-9PRHHTGC.cjs.map

package/dist/utils-9PRHHTGC.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils-9PRHHTGC.cjs","names":["authEE","HTTPException","isReservedRequestContextKey","MASTRA_RESOURCE_ID_KEY","MastraMemory"],"sources":["../src/server/fga-permissions.ts","../src/server/handlers/utils.ts"],"sourcesContent":["/**\n * Safe re-export of `MastraFGAPermissions` from `@mastra/core/auth/ee`.\n *\n * Why this shim exists:\n * `MastraFGAPermissions` was introduced in `@mastra/core@1.32.0`. Earlier\n * versions of `@mastra/core` ship `@mastra/core/auth/ee` but do not export\n * this constant. A direct named import (`import { MastraFGAPermissions }\n * from '@mastra/core/auth/ee'`) fails at ESM link time when this version\n * of `@mastra/server` is paired with `@mastra/core < 1.32.0`, taking the\n * entire user bundle down before any code runs.\n *\n * A namespace import tolerates missing names — `ns.MissingExport` is just\n * `undefined`, no link-time error. We then expose the permission map.\n *\n * Fallback values:\n * If the consuming `@mastra/core` does not export `MastraFGAPermissions`,\n * we substitute a hardcoded map of the canonical permission strings used\n * by routes in `@mastra/server`. This preserves the explicit RBAC\n * permission overrides those routes already had as string literals in\n * `@mastra/server@1.31.0` (e.g. `requiresPermission: \"agents:execute\"`\n * on `/v1/responses`). Without this fallback, `requiresPermission` would\n * be `undefined` on old core and the auth layer would derive the wrong\n * permission from the route path (e.g. `v1:write` instead of\n * `agents:execute`), breaking RBAC users who upgrade `@mastra/server`\n * but stay on `@mastra/core@1.31.0`.\n *\n * Once the consuming `@mastra/core` is on `1.32.0+` the values are real\n * and behaviour is identical to a direct named import.\n */\n\nimport * as authEE from '@mastra/core/auth/ee';\n\n// Canonical strings for the FGA permission keys actually referenced by\n// `@mastra/server` source. Mirrors `MastraFGAPermissions` in\n// `@mastra/core@1.32.0+` for these specific keys, and matches the string\n// literals previously hardcoded on the same routes in `@mastra/server@1.31.0`.\nconst FALLBACK_PERMISSIONS = {\n  AGENTS_CREATE: 'agents:create',\n  AGENTS_DELETE: 'agents:delete',\n  AGENTS_EXECUTE: 'agents:execute',\n  AGENTS_READ: 'agents:read',\n  KNOWLEDGE_READ: 'knowledge:read',\n  MEMORY_DELETE: 'memory:delete',\n  MEMORY_READ: 'memory:read',\n  MEMORY_WRITE: 'memory:write',\n  TOOLS_EXECUTE: 'tools:execute',\n  TOOLS_READ: 'tools:read',\n  STORED_WORKFLOWS_READ: 'stored-workflows:read',\n  STORED_WORKFLOWS_WRITE: 'stored-workflows:write',\n  WORKFLOWS_EXECUTE: 'workflows:execute',\n  WORKFLOWS_READ: 'workflows:read',\n} as const;\n\nconst realPermissions = (authEE as any).MastraFGAPermissions;\n\n// Typed as `any` on purpose: consumers of `@mastra/server` may run their\n// typecheck against a `@mastra/core` that doesn't export `MastraFGAPermissions`\n// (anything < 1.32.0). Pinning to the real type would push that name into the\n// emitted `.d.ts` and break downstream typecheck. `any` lets the property\n// accesses (`MastraFGAPermissions.AGENTS_READ`) flow through cleanly on every\n// supported core.\nexport const MastraFGAPermissions: any =\n  // Merge so a core that exports the map without a newer key (older than this PR) still resolves it.\n  { ...FALLBACK_PERMISSIONS, ...(realPermissions ?? {}) };\n","import type { Mastra } from '@mastra/core';\nimport type { IFGAProvider, MastraFGAPermissionInput } from '@mastra/core/auth/ee';\nimport type { RequestContext } from '@mastra/core/di';\nimport { MastraMemory } from '@mastra/core/memory';\nimport type { Workflow } from '@mastra/core/workflows';\nimport {\n  MASTRA_AUTH_MODE_KEY,\n  MASTRA_RESOURCE_ID_KEY,\n  MASTRA_THREAD_ID_KEY,\n  isReservedRequestContextKey,\n} from '../constants';\nimport { MastraFGAPermissions } from '../fga-permissions';\nimport { HTTPException } from '../http-exception';\n\n/**\n * Resolves a workflow by id or registration key from the set Mastra exposes\n * publicly. Unlike `mastra.getWorkflowById`, this excludes hidden internal\n * workflows (e.g. a durable agent's backing loop), which must never be\n * runnable through HTTP routes.\n */\nexport function getPublicWorkflowById(mastra: Mastra, workflowId: string): Workflow | undefined {\n  const workflows = mastra.listWorkflows();\n  return (\n    Object.values(workflows).find(workflow => workflow.id === workflowId) ??\n    (Object.hasOwn(workflows, workflowId) ? workflows[workflowId] : undefined)\n  );\n}\n\n/**\n * Resolves the FGA provider a handler should use for this request, following\n * the same auth-mode-aware selection as the route-level checks: Studio auth\n * requests use `studio.fga` when it is configured, and everything else uses\n * `server.fga`.\n *\n * Returns `undefined` when FGA is not configured at all. When FGA is\n * configured but no provider applies to this request (for example `studio.fga`\n * is set and the request used server auth), the request is denied rather than\n * treated as unrestricted.\n */\nexport function getHandlerFGAProvider(mastra: any, requestContext?: RequestContext): IFGAProvider | undefined {\n  const studioFga = mastra?.getStudio?.()?.fga as IFGAProvider | undefined;\n  const serverFga = mastra?.getServer?.()?.fga as IFGAProvider | undefined;\n\n  if (requestContext?.get(MASTRA_AUTH_MODE_KEY) === 'studio' && studioFga) return studioFga;\n  if (serverFga) return serverFga;\n  if (studioFga) {\n    throw new HTTPException(403, { message: 'Access denied: no FGA provider is configured for this request' });\n  }\n  return undefined;\n}\n\n// Validation helper\nexport function validateBody(body: Record<string, unknown>) {\n  const errorResponse = Object.entries(body).reduce<Record<string, string>>((acc, [key, value]) => {\n    if (!value) {\n      acc[key] = `Argument \"${key}\" is required`;\n    }\n    return acc;\n  }, {});\n\n  if (Object.keys(errorResponse).length > 0) {\n    throw new HTTPException(400, { message: Object.values(errorResponse)[0] });\n  }\n}\n\n/**\n * sanitizes the body by removing disallowed keys.\n * @param body body to sanitize\n * @param disallowedKeys keys to remove from the body\n */\nexport function sanitizeBody(body: Record<string, unknown>, disallowedKeys: string[]) {\n  for (const key of disallowedKeys) {\n    if (key in body) {\n      delete body[key];\n    }\n  }\n}\n\nconst CREDENTIAL_HEADER_NAMES = new Set([\n  'authorization',\n  'proxy-authorization',\n  'x-api-key',\n  'api-key',\n  'x-goog-api-key',\n  'cookie',\n]);\n\n/**\n * Removes credential-bearing headers from client-supplied `modelSettings.headers`\n * so a caller's own auth (e.g. the app's bearer token) can never override the\n * provider credential configured on the server. Non-credential headers are kept.\n */\nexport function stripClientCredentialHeaders(body: Record<string, unknown>) {\n  const modelSettings = body.modelSettings;\n  if (!modelSettings || typeof modelSettings !== 'object') return;\n  const headers = (modelSettings as { headers?: unknown }).headers;\n  if (!headers || typeof headers !== 'object') return;\n\n  const kept = Object.fromEntries(\n    Object.entries(headers).filter(([name]) => !CREDENTIAL_HEADER_NAMES.has(name.toLowerCase())),\n  );\n  body.modelSettings = { ...modelSettings, headers: kept };\n}\n\nexport function parsePerPage(\n  value: string | undefined,\n  defaultValue: number = 100,\n  max: number = 1000,\n): number | false {\n  const normalized = (value || '').trim().toLowerCase();\n  // Handle explicit false to bypass pagination\n  if (normalized === 'false') {\n    return false;\n  }\n  const parsed = parseInt(value || String(defaultValue), 10);\n  if (isNaN(parsed)) return defaultValue;\n  return Math.min(max, Math.max(1, parsed));\n}\n\n/**\n * Parses filter query parameters into a key-value object.\n */\nexport function parseFilters(filters: string | string[] | undefined): Record<string, string> | undefined {\n  if (!filters) return undefined;\n\n  return Object.fromEntries(\n    (Array.isArray(filters) ? filters : [filters]).map((attr: string) => {\n      const [key, ...valueParts] = attr.split(':');\n      const value = valueParts.join(':'); // ✅ Handles colons in values\n      return [key, value];\n    }),\n  );\n}\n\n/**\n * Merges a body-supplied requestContext into the trusted server RequestContext.\n * The server context is authoritative: reserved keys are skipped and body values\n * only fill keys the server context has not already set.\n */\nexport function mergeBodyRequestContext(serverRequestContext: RequestContext, bodyRequestContext: unknown): void {\n  if (!bodyRequestContext || typeof bodyRequestContext !== 'object') {\n    return;\n  }\n\n  for (const [key, value] of Object.entries(bodyRequestContext)) {\n    if (isReservedRequestContextKey(key)) continue;\n    if (serverRequestContext.get(key) === undefined) {\n      serverRequestContext.set(key, value);\n    }\n  }\n}\n\n// ============================================================================\n// Authorization Utilities\n// ============================================================================\n\n/**\n * Gets the effective resourceId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveResourceId(\n  requestContext: RequestContext | undefined,\n  clientResourceId: string | undefined,\n): string | undefined {\n  const contextResourceId = requestContext?.get(MASTRA_RESOURCE_ID_KEY) as string | undefined;\n  return contextResourceId || clientResourceId;\n}\n\n/**\n * Returns the resource id resolved from the request context alone (set via\n * `mapUserToResourceId` or the `x-resource-id` header), ignoring any\n * client-provided value. Its presence indicates a resource-scoped caller;\n * its absence indicates a privileged/service context.\n */\nexport function getContextResourceId(requestContext: RequestContext | undefined): string | undefined {\n  return requestContext?.get(MASTRA_RESOURCE_ID_KEY) as string | undefined;\n}\n\n/**\n * Ensures a memory request has a resolvable resource ID. The body's\n * `memory.resource` is optional so authenticated setups can rely on the\n * server-derived resource ID (MASTRA_RESOURCE_ID_KEY set via mapUserToResourceId).\n * When neither the body nor the request context provides one, reject with a\n * clear 400 instead of failing deep inside agent execution.\n */\nexport function requireEffectiveResourceId(\n  effectiveResourceId: string | undefined,\n): asserts effectiveResourceId is string {\n  if (!effectiveResourceId) {\n    throw new HTTPException(400, {\n      message:\n        'A resource ID is required when using memory. Provide memory.resource in the request body, or configure server auth with mapUserToResourceId to derive it from the authenticated user.',\n    });\n  }\n}\n\n/**\n * Gets the effective threadId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveThreadId(\n  requestContext: RequestContext | undefined,\n  clientThreadId: string | undefined,\n): string | undefined {\n  const contextThreadId = requestContext?.get(MASTRA_THREAD_ID_KEY) as string | undefined;\n  return contextThreadId || clientThreadId;\n}\n\n/**\n * Applies the effective threadId to a client memory thread option. Object\n * threads keep their other fields (metadata, title, ...) so they reach thread\n * creation; a client-supplied resourceId is dropped because the server decides\n * the resource.\n */\nexport function applyEffectiveThreadId<T extends string | { id: string } | undefined>(\n  thread: T,\n  effectiveThreadId: string | undefined,\n): T | string {\n  if (!effectiveThreadId) return thread;\n  if (thread && typeof thread === 'object') {\n    const { resourceId: _resourceId, ...fields } = thread as { id: string; resourceId?: unknown };\n    return { ...fields, id: effectiveThreadId } as T;\n  }\n  return effectiveThreadId;\n}\n\n/**\n * Validates that a thread belongs to the specified resourceId.\n * Throws 403 if the thread exists but belongs to a different resource.\n * Threads with no resourceId are accessible to all (shared threads).\n */\nexport async function validateThreadOwnership(\n  thread: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (thread && effectiveResourceId && thread.resourceId && thread.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: thread belongs to a different resource' });\n  }\n}\n\n/**\n * Validates both coarse resource ownership and fine-grained thread access.\n * FGA enforcement is a no-op when no FGA provider is configured.\n */\nexport async function enforceThreadAccess({\n  mastra,\n  requestContext,\n  threadId,\n  thread,\n  effectiveResourceId,\n  permission = MastraFGAPermissions.MEMORY_READ,\n}: {\n  mastra: any;\n  requestContext?: RequestContext;\n  threadId: string;\n  thread?: { resourceId?: string | null } | null;\n  effectiveResourceId?: string;\n  permission?: MastraFGAPermissionInput;\n}): Promise<void> {\n  await validateThreadOwnership(thread, effectiveResourceId);\n\n  const fgaProvider = getHandlerFGAProvider(mastra, requestContext);\n  if (!fgaProvider) {\n    return;\n  }\n\n  const user = requestContext?.get('user');\n  if (!user || typeof user !== 'object') {\n    throw new HTTPException(403, { message: 'FGA authorization denied: authenticated user is required' });\n  }\n\n  await MastraMemory.checkThreadFGA({\n    mastra,\n    user: user as { id: string; [key: string]: unknown },\n    threadId,\n    resourceId: thread?.resourceId ?? effectiveResourceId,\n    requestContext,\n    permission,\n    fgaProvider,\n  });\n}\n\n/**\n * Validates that a caller may act on a workflow run.\n *\n * Without `server.auth.mapUserToResourceId` there is no tenancy model, and only a mismatch\n * between two present resource ids is denied. With a mapper, a resource-scoped caller may only\n * act on runs it owns (an owner-less run is not its run). An unscoped caller is a\n * privileged/service context (see getContextResourceId), but that privilege is only granted when\n * an FGA provider authorizes the route; otherwise it is refused rather than granted implicitly,\n * as on the thread-transfer route.\n */\nexport async function validateRunOwnership(\n  run: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n  mastra?: {\n    getServer?: () => { auth?: unknown; fga?: unknown } | undefined;\n    getStudio?: () => { fga?: unknown } | undefined;\n  },\n  requestContext?: RequestContext,\n): Promise<void> {\n  if (!run) return;\n  const server = mastra?.getServer?.();\n  const tenancy =\n    typeof (server?.auth as { mapUserToResourceId?: unknown } | undefined)?.mapUserToResourceId === 'function';\n  if (!tenancy) {\n    if (effectiveResourceId && run.resourceId && run.resourceId !== effectiveResourceId) {\n      throw new HTTPException(403, { message: 'Access denied: workflow run belongs to a different resource' });\n    }\n    return;\n  }\n  if (effectiveResourceId) {\n    if (run.resourceId !== effectiveResourceId) {\n      throw new HTTPException(403, { message: 'Access denied: workflow run belongs to a different resource' });\n    }\n    return;\n  }\n  if (!getHandlerFGAProvider(mastra, requestContext)) {\n    throw new HTTPException(403, {\n      message:\n        'Access denied: unscoped workflow run access requires explicit authorization. Configure an FGA provider to authorize privileged run access.',\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,MAAM,uBAAuB;CAC3B,eAAe;CACf,eAAe;CACf,gBAAgB;CAChB,aAAa;CACb,gBAAgB;CAChB,eAAe;CACf,aAAa;CACb,cAAc;CACd,eAAe;CACf,YAAY;CACZ,uBAAuB;CACvB,wBAAwB;CACxB,mBAAmB;CACnB,gBAAgB;AAClB;AAEA,MAAM,kBAAmBA,qBAAe;AAQxC,MAAa,uBAEX;CAAE,GAAG;CAAsB,GAAI,mBAAmB,CAAC;AAAG;;;;;;;;AC3CxD,SAAgB,sBAAsB,QAAgB,YAA0C;CAC9F,MAAM,YAAY,OAAO,cAAc;CACvC,OACE,OAAO,OAAO,SAAS,CAAC,CAAC,MAAK,aAAY,SAAS,OAAO,UAAU,MACnE,OAAO,OAAO,WAAW,UAAU,IAAI,UAAU,cAAc,KAAA;AAEpE;;;;;;;;;;;;AAaA,SAAgB,sBAAsB,QAAa,gBAA2D;CAC5G,MAAM,YAAY,QAAQ,YAAY,CAAC,EAAE;CACzC,MAAM,YAAY,QAAQ,YAAY,CAAC,EAAE;CAEzC,IAAI,gBAAgB,IAAA,kBAAwB,MAAM,YAAY,WAAW,OAAO;CAChF,IAAI,WAAW,OAAO;CACtB,IAAI,WACF,MAAM,IAAIC,uBAAAA,cAAc,KAAK,EAAE,SAAS,gEAAgE,CAAC;AAG7G;AAGA,SAAgB,aAAa,MAA+B;CAC1D,MAAM,gBAAgB,OAAO,QAAQ,IAAI,CAAC,CAAC,QAAgC,KAAK,CAAC,KAAK,WAAW;EAC/F,IAAI,CAAC,OACH,IAAI,OAAO,aAAa,IAAI;EAE9B,OAAO;CACT,GAAG,CAAC,CAAC;CAEL,IAAI,OAAO,KAAK,aAAa,CAAC,CAAC,SAAS,GACtC,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,OAAO,OAAO,aAAa,CAAC,CAAC,GAAG,CAAC;AAE7E;;;;;;AAOA,SAAgB,aAAa,MAA+B,gBAA0B;CACpF,KAAK,MAAM,OAAO,gBAChB,IAAI,OAAO,MACT,OAAO,KAAK;AAGlB;AAEA,MAAM,0CAA0B,IAAI,IAAI;CACtC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,SAAgB,6BAA6B,MAA+B;CAC1E,MAAM,gBAAgB,KAAK;CAC3B,IAAI,CAAC,iBAAiB,OAAO,kBAAkB,UAAU;CACzD,MAAM,UAAW,cAAwC;CACzD,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU;CAE7C,MAAM,OAAO,OAAO,YAClB,OAAO,QAAQ,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,wBAAwB,IAAI,KAAK,YAAY,CAAC,CAAC,CAC7F;CACA,KAAK,gBAAgB;EAAE,GAAG;EAAe,SAAS;CAAK;AACzD;AAEA,SAAgB,aACd,OACA,eAAuB,KACvB,MAAc,KACE;CAGhB,KAFoB,SAAS,GAAA,CAAI,KAAK,CAAC,CAAC,YAE3B,MAAM,SACjB,OAAO;CAET,MAAM,SAAS,SAAS,SAAS,OAAO,YAAY,GAAG,EAAE;CACzD,IAAI,MAAM,MAAM,GAAG,OAAO;CAC1B,OAAO,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,MAAM,CAAC;AAC1C;;;;AAKA,SAAgB,aAAa,SAA4E;CACvG,IAAI,CAAC,SAAS,OAAO,KAAA;CAErB,OAAO,OAAO,aACX,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO,EAAA,CAAG,KAAK,SAAiB;EACnE,MAAM,CAAC,KAAK,GAAG,cAAc,KAAK,MAAM,GAAG;EAE3C,OAAO,CAAC,KADM,WAAW,KAAK,GACb,CAAC;CACpB,CAAC,CACH;AACF;;;;;;AAOA,SAAgB,wBAAwB,sBAAsC,oBAAmC;CAC/G,IAAI,CAAC,sBAAsB,OAAO,uBAAuB,UACvD;CAGF,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,kBAAkB,GAAG;EAC7D,IAAIC,kBAAAA,4BAA4B,GAAG,GAAG;EACtC,IAAI,qBAAqB,IAAI,GAAG,MAAM,KAAA,GACpC,qBAAqB,IAAI,KAAK,KAAK;CAEvC;AACF;;;;;AAUA,SAAgB,uBACd,gBACA,kBACoB;CAEpB,OAD0B,gBAAgB,IAAA,oBAA0B,KACxC;AAC9B;;;;;;;AAQA,SAAgB,qBAAqB,gBAAgE;CACnG,OAAO,gBAAgB,IAAIC,kBAAAA,sBAAsB;AACnD;;;;;;;;AASA,SAAgB,2BACd,qBACuC;CACvC,IAAI,CAAC,qBACH,MAAM,IAAIF,uBAAAA,cAAc,KAAK,EAC3B,SACE,wLACJ,CAAC;AAEL;;;;;AAMA,SAAgB,qBACd,gBACA,gBACoB;CAEpB,OADwB,gBAAgB,IAAA,kBAAwB,KACtC;AAC5B;;;;;;;AAQA,SAAgB,uBACd,QACA,mBACY;CACZ,IAAI,CAAC,mBAAmB,OAAO;CAC/B,IAAI,UAAU,OAAO,WAAW,UAAU;EACxC,MAAM,EAAE,YAAY,aAAa,GAAG,WAAW;EAC/C,OAAO;GAAE,GAAG;GAAQ,IAAI;EAAkB;CAC5C;CACA,OAAO;AACT;;;;;;AAOA,eAAsB,wBACpB,QACA,qBACe;CACf,IAAI,UAAU,uBAAuB,OAAO,cAAc,OAAO,eAAe,qBAC9E,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,wDAAwD,CAAC;AAErG;;;;;AAMA,eAAsB,oBAAoB,EACxC,QACA,gBACA,UACA,QACA,qBACA,aAAa,qBAAqB,eAQlB;CAChB,MAAM,wBAAwB,QAAQ,mBAAmB;CAEzD,MAAM,cAAc,sBAAsB,QAAQ,cAAc;CAChE,IAAI,CAAC,aACH;CAGF,MAAM,OAAO,gBAAgB,IAAI,MAAM;CACvC,IAAI,CAAC,QAAQ,OAAO,SAAS,UAC3B,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,2DAA2D,CAAC;CAGtG,MAAMG,oBAAAA,aAAa,eAAe;EAChC;EACM;EACN;EACA,YAAY,QAAQ,cAAc;EAClC;EACA;EACA;CACF,CAAC;AACH;;;;;;;;;;;AAYA,eAAsB,qBACpB,KACA,qBACA,QAIA,gBACe;CACf,IAAI,CAAC,KAAK;CAIV,IAAI,EADF,SAFa,QAAQ,YAAY,EAAA,EAEjB,KAAA,EAAwD,wBAAwB,aACpF;EACZ,IAAI,uBAAuB,IAAI,cAAc,IAAI,eAAe,qBAC9D,MAAM,IAAIH,uBAAAA,cAAc,KAAK,EAAE,SAAS,8DAA8D,CAAC;EAEzG;CACF;CACA,IAAI,qBAAqB;EACvB,IAAI,IAAI,eAAe,qBACrB,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAAE,SAAS,8DAA8D,CAAC;EAEzG;CACF;CACA,IAAI,CAAC,sBAAsB,QAAQ,cAAc,GAC/C,MAAM,IAAIA,uBAAAA,cAAc,KAAK,EAC3B,SACE,6IACJ,CAAC;AAEL"}

package/dist/{utils-DHxjw4Tn.js → utils-B15w-1hm.js}

@@ -1,5 +1,5 @@
 import { t as HTTPException } from "./http-exception-CzaWkxMl.js";
-import { m as isReservedRequestContextKey, o as MASTRA_RESOURCE_ID_KEY } from "./constants-ohUUT3Vg.js";
+import { h as isReservedRequestContextKey, s as MASTRA_RESOURCE_ID_KEY } from "./constants-CXAvBYcz.js";
 import * as authEE from "@mastra/core/auth/ee";
 import { MastraMemory } from "@mastra/core/memory";
 // src/server/fga-permissions.ts
@@ -37,6 +37,7 @@ const FALLBACK_PERMISSIONS = {
 	AGENTS_DELETE: "agents:delete",
 	AGENTS_EXECUTE: "agents:execute",
 	AGENTS_READ: "agents:read",
+	KNOWLEDGE_READ: "knowledge:read",
 	MEMORY_DELETE: "memory:delete",
 	MEMORY_READ: "memory:read",
 	MEMORY_WRITE: "memory:write",
@@ -48,7 +49,10 @@ const FALLBACK_PERMISSIONS = {
 	WORKFLOWS_READ: "workflows:read"
 };
 const realPermissions = authEE.MastraFGAPermissions;
-const MastraFGAPermissions = realPermissions && Object.keys(realPermissions).length > 0 ? realPermissions : FALLBACK_PERMISSIONS;
+const MastraFGAPermissions = {
+	...FALLBACK_PERMISSIONS,
+	...realPermissions ?? {}
+};
 // src/server/handlers/utils.ts
 /**
 * Resolves a workflow by id or registration key from the set Mastra exposes
@@ -247,4 +251,4 @@ async function validateRunOwnership(run, effectiveResourceId, mastra, requestCon
 }
 export { MastraFGAPermissions as _, getEffectiveThreadId as a, mergeBodyRequestContext as c, requireEffectiveResourceId as d, sanitizeBody as f, validateThreadOwnership as g, validateRunOwnership as h, getEffectiveResourceId as i, parseFilters as l, validateBody as m, enforceThreadAccess as n, getHandlerFGAProvider as o, stripClientCredentialHeaders as p, getContextResourceId as r, getPublicWorkflowById as s, applyEffectiveThreadId as t, parsePerPage as u };
 
-//# sourceMappingURL=utils-DHxjw4Tn.js.map
+//# sourceMappingURL=utils-B15w-1hm.js.map

package/dist/utils-B15w-1hm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils-B15w-1hm.js","names":[],"sources":["../src/server/fga-permissions.ts","../src/server/handlers/utils.ts"],"sourcesContent":["/**\n * Safe re-export of `MastraFGAPermissions` from `@mastra/core/auth/ee`.\n *\n * Why this shim exists:\n * `MastraFGAPermissions` was introduced in `@mastra/core@1.32.0`. Earlier\n * versions of `@mastra/core` ship `@mastra/core/auth/ee` but do not export\n * this constant. A direct named import (`import { MastraFGAPermissions }\n * from '@mastra/core/auth/ee'`) fails at ESM link time when this version\n * of `@mastra/server` is paired with `@mastra/core < 1.32.0`, taking the\n * entire user bundle down before any code runs.\n *\n * A namespace import tolerates missing names — `ns.MissingExport` is just\n * `undefined`, no link-time error. We then expose the permission map.\n *\n * Fallback values:\n * If the consuming `@mastra/core` does not export `MastraFGAPermissions`,\n * we substitute a hardcoded map of the canonical permission strings used\n * by routes in `@mastra/server`. This preserves the explicit RBAC\n * permission overrides those routes already had as string literals in\n * `@mastra/server@1.31.0` (e.g. `requiresPermission: \"agents:execute\"`\n * on `/v1/responses`). Without this fallback, `requiresPermission` would\n * be `undefined` on old core and the auth layer would derive the wrong\n * permission from the route path (e.g. `v1:write` instead of\n * `agents:execute`), breaking RBAC users who upgrade `@mastra/server`\n * but stay on `@mastra/core@1.31.0`.\n *\n * Once the consuming `@mastra/core` is on `1.32.0+` the values are real\n * and behaviour is identical to a direct named import.\n */\n\nimport * as authEE from '@mastra/core/auth/ee';\n\n// Canonical strings for the FGA permission keys actually referenced by\n// `@mastra/server` source. Mirrors `MastraFGAPermissions` in\n// `@mastra/core@1.32.0+` for these specific keys, and matches the string\n// literals previously hardcoded on the same routes in `@mastra/server@1.31.0`.\nconst FALLBACK_PERMISSIONS = {\n  AGENTS_CREATE: 'agents:create',\n  AGENTS_DELETE: 'agents:delete',\n  AGENTS_EXECUTE: 'agents:execute',\n  AGENTS_READ: 'agents:read',\n  KNOWLEDGE_READ: 'knowledge:read',\n  MEMORY_DELETE: 'memory:delete',\n  MEMORY_READ: 'memory:read',\n  MEMORY_WRITE: 'memory:write',\n  TOOLS_EXECUTE: 'tools:execute',\n  TOOLS_READ: 'tools:read',\n  STORED_WORKFLOWS_READ: 'stored-workflows:read',\n  STORED_WORKFLOWS_WRITE: 'stored-workflows:write',\n  WORKFLOWS_EXECUTE: 'workflows:execute',\n  WORKFLOWS_READ: 'workflows:read',\n} as const;\n\nconst realPermissions = (authEE as any).MastraFGAPermissions;\n\n// Typed as `any` on purpose: consumers of `@mastra/server` may run their\n// typecheck against a `@mastra/core` that doesn't export `MastraFGAPermissions`\n// (anything < 1.32.0). Pinning to the real type would push that name into the\n// emitted `.d.ts` and break downstream typecheck. `any` lets the property\n// accesses (`MastraFGAPermissions.AGENTS_READ`) flow through cleanly on every\n// supported core.\nexport const MastraFGAPermissions: any =\n  // Merge so a core that exports the map without a newer key (older than this PR) still resolves it.\n  { ...FALLBACK_PERMISSIONS, ...(realPermissions ?? {}) };\n","import type { Mastra } from '@mastra/core';\nimport type { IFGAProvider, MastraFGAPermissionInput } from '@mastra/core/auth/ee';\nimport type { RequestContext } from '@mastra/core/di';\nimport { MastraMemory } from '@mastra/core/memory';\nimport type { Workflow } from '@mastra/core/workflows';\nimport {\n  MASTRA_AUTH_MODE_KEY,\n  MASTRA_RESOURCE_ID_KEY,\n  MASTRA_THREAD_ID_KEY,\n  isReservedRequestContextKey,\n} from '../constants';\nimport { MastraFGAPermissions } from '../fga-permissions';\nimport { HTTPException } from '../http-exception';\n\n/**\n * Resolves a workflow by id or registration key from the set Mastra exposes\n * publicly. Unlike `mastra.getWorkflowById`, this excludes hidden internal\n * workflows (e.g. a durable agent's backing loop), which must never be\n * runnable through HTTP routes.\n */\nexport function getPublicWorkflowById(mastra: Mastra, workflowId: string): Workflow | undefined {\n  const workflows = mastra.listWorkflows();\n  return (\n    Object.values(workflows).find(workflow => workflow.id === workflowId) ??\n    (Object.hasOwn(workflows, workflowId) ? workflows[workflowId] : undefined)\n  );\n}\n\n/**\n * Resolves the FGA provider a handler should use for this request, following\n * the same auth-mode-aware selection as the route-level checks: Studio auth\n * requests use `studio.fga` when it is configured, and everything else uses\n * `server.fga`.\n *\n * Returns `undefined` when FGA is not configured at all. When FGA is\n * configured but no provider applies to this request (for example `studio.fga`\n * is set and the request used server auth), the request is denied rather than\n * treated as unrestricted.\n */\nexport function getHandlerFGAProvider(mastra: any, requestContext?: RequestContext): IFGAProvider | undefined {\n  const studioFga = mastra?.getStudio?.()?.fga as IFGAProvider | undefined;\n  const serverFga = mastra?.getServer?.()?.fga as IFGAProvider | undefined;\n\n  if (requestContext?.get(MASTRA_AUTH_MODE_KEY) === 'studio' && studioFga) return studioFga;\n  if (serverFga) return serverFga;\n  if (studioFga) {\n    throw new HTTPException(403, { message: 'Access denied: no FGA provider is configured for this request' });\n  }\n  return undefined;\n}\n\n// Validation helper\nexport function validateBody(body: Record<string, unknown>) {\n  const errorResponse = Object.entries(body).reduce<Record<string, string>>((acc, [key, value]) => {\n    if (!value) {\n      acc[key] = `Argument \"${key}\" is required`;\n    }\n    return acc;\n  }, {});\n\n  if (Object.keys(errorResponse).length > 0) {\n    throw new HTTPException(400, { message: Object.values(errorResponse)[0] });\n  }\n}\n\n/**\n * sanitizes the body by removing disallowed keys.\n * @param body body to sanitize\n * @param disallowedKeys keys to remove from the body\n */\nexport function sanitizeBody(body: Record<string, unknown>, disallowedKeys: string[]) {\n  for (const key of disallowedKeys) {\n    if (key in body) {\n      delete body[key];\n    }\n  }\n}\n\nconst CREDENTIAL_HEADER_NAMES = new Set([\n  'authorization',\n  'proxy-authorization',\n  'x-api-key',\n  'api-key',\n  'x-goog-api-key',\n  'cookie',\n]);\n\n/**\n * Removes credential-bearing headers from client-supplied `modelSettings.headers`\n * so a caller's own auth (e.g. the app's bearer token) can never override the\n * provider credential configured on the server. Non-credential headers are kept.\n */\nexport function stripClientCredentialHeaders(body: Record<string, unknown>) {\n  const modelSettings = body.modelSettings;\n  if (!modelSettings || typeof modelSettings !== 'object') return;\n  const headers = (modelSettings as { headers?: unknown }).headers;\n  if (!headers || typeof headers !== 'object') return;\n\n  const kept = Object.fromEntries(\n    Object.entries(headers).filter(([name]) => !CREDENTIAL_HEADER_NAMES.has(name.toLowerCase())),\n  );\n  body.modelSettings = { ...modelSettings, headers: kept };\n}\n\nexport function parsePerPage(\n  value: string | undefined,\n  defaultValue: number = 100,\n  max: number = 1000,\n): number | false {\n  const normalized = (value || '').trim().toLowerCase();\n  // Handle explicit false to bypass pagination\n  if (normalized === 'false') {\n    return false;\n  }\n  const parsed = parseInt(value || String(defaultValue), 10);\n  if (isNaN(parsed)) return defaultValue;\n  return Math.min(max, Math.max(1, parsed));\n}\n\n/**\n * Parses filter query parameters into a key-value object.\n */\nexport function parseFilters(filters: string | string[] | undefined): Record<string, string> | undefined {\n  if (!filters) return undefined;\n\n  return Object.fromEntries(\n    (Array.isArray(filters) ? filters : [filters]).map((attr: string) => {\n      const [key, ...valueParts] = attr.split(':');\n      const value = valueParts.join(':'); // ✅ Handles colons in values\n      return [key, value];\n    }),\n  );\n}\n\n/**\n * Merges a body-supplied requestContext into the trusted server RequestContext.\n * The server context is authoritative: reserved keys are skipped and body values\n * only fill keys the server context has not already set.\n */\nexport function mergeBodyRequestContext(serverRequestContext: RequestContext, bodyRequestContext: unknown): void {\n  if (!bodyRequestContext || typeof bodyRequestContext !== 'object') {\n    return;\n  }\n\n  for (const [key, value] of Object.entries(bodyRequestContext)) {\n    if (isReservedRequestContextKey(key)) continue;\n    if (serverRequestContext.get(key) === undefined) {\n      serverRequestContext.set(key, value);\n    }\n  }\n}\n\n// ============================================================================\n// Authorization Utilities\n// ============================================================================\n\n/**\n * Gets the effective resourceId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveResourceId(\n  requestContext: RequestContext | undefined,\n  clientResourceId: string | undefined,\n): string | undefined {\n  const contextResourceId = requestContext?.get(MASTRA_RESOURCE_ID_KEY) as string | undefined;\n  return contextResourceId || clientResourceId;\n}\n\n/**\n * Returns the resource id resolved from the request context alone (set via\n * `mapUserToResourceId` or the `x-resource-id` header), ignoring any\n * client-provided value. Its presence indicates a resource-scoped caller;\n * its absence indicates a privileged/service context.\n */\nexport function getContextResourceId(requestContext: RequestContext | undefined): string | undefined {\n  return requestContext?.get(MASTRA_RESOURCE_ID_KEY) as string | undefined;\n}\n\n/**\n * Ensures a memory request has a resolvable resource ID. The body's\n * `memory.resource` is optional so authenticated setups can rely on the\n * server-derived resource ID (MASTRA_RESOURCE_ID_KEY set via mapUserToResourceId).\n * When neither the body nor the request context provides one, reject with a\n * clear 400 instead of failing deep inside agent execution.\n */\nexport function requireEffectiveResourceId(\n  effectiveResourceId: string | undefined,\n): asserts effectiveResourceId is string {\n  if (!effectiveResourceId) {\n    throw new HTTPException(400, {\n      message:\n        'A resource ID is required when using memory. Provide memory.resource in the request body, or configure server auth with mapUserToResourceId to derive it from the authenticated user.',\n    });\n  }\n}\n\n/**\n * Gets the effective threadId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveThreadId(\n  requestContext: RequestContext | undefined,\n  clientThreadId: string | undefined,\n): string | undefined {\n  const contextThreadId = requestContext?.get(MASTRA_THREAD_ID_KEY) as string | undefined;\n  return contextThreadId || clientThreadId;\n}\n\n/**\n * Applies the effective threadId to a client memory thread option. Object\n * threads keep their other fields (metadata, title, ...) so they reach thread\n * creation; a client-supplied resourceId is dropped because the server decides\n * the resource.\n */\nexport function applyEffectiveThreadId<T extends string | { id: string } | undefined>(\n  thread: T,\n  effectiveThreadId: string | undefined,\n): T | string {\n  if (!effectiveThreadId) return thread;\n  if (thread && typeof thread === 'object') {\n    const { resourceId: _resourceId, ...fields } = thread as { id: string; resourceId?: unknown };\n    return { ...fields, id: effectiveThreadId } as T;\n  }\n  return effectiveThreadId;\n}\n\n/**\n * Validates that a thread belongs to the specified resourceId.\n * Throws 403 if the thread exists but belongs to a different resource.\n * Threads with no resourceId are accessible to all (shared threads).\n */\nexport async function validateThreadOwnership(\n  thread: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (thread && effectiveResourceId && thread.resourceId && thread.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: thread belongs to a different resource' });\n  }\n}\n\n/**\n * Validates both coarse resource ownership and fine-grained thread access.\n * FGA enforcement is a no-op when no FGA provider is configured.\n */\nexport async function enforceThreadAccess({\n  mastra,\n  requestContext,\n  threadId,\n  thread,\n  effectiveResourceId,\n  permission = MastraFGAPermissions.MEMORY_READ,\n}: {\n  mastra: any;\n  requestContext?: RequestContext;\n  threadId: string;\n  thread?: { resourceId?: string | null } | null;\n  effectiveResourceId?: string;\n  permission?: MastraFGAPermissionInput;\n}): Promise<void> {\n  await validateThreadOwnership(thread, effectiveResourceId);\n\n  const fgaProvider = getHandlerFGAProvider(mastra, requestContext);\n  if (!fgaProvider) {\n    return;\n  }\n\n  const user = requestContext?.get('user');\n  if (!user || typeof user !== 'object') {\n    throw new HTTPException(403, { message: 'FGA authorization denied: authenticated user is required' });\n  }\n\n  await MastraMemory.checkThreadFGA({\n    mastra,\n    user: user as { id: string; [key: string]: unknown },\n    threadId,\n    resourceId: thread?.resourceId ?? effectiveResourceId,\n    requestContext,\n    permission,\n    fgaProvider,\n  });\n}\n\n/**\n * Validates that a caller may act on a workflow run.\n *\n * Without `server.auth.mapUserToResourceId` there is no tenancy model, and only a mismatch\n * between two present resource ids is denied. With a mapper, a resource-scoped caller may only\n * act on runs it owns (an owner-less run is not its run). An unscoped caller is a\n * privileged/service context (see getContextResourceId), but that privilege is only granted when\n * an FGA provider authorizes the route; otherwise it is refused rather than granted implicitly,\n * as on the thread-transfer route.\n */\nexport async function validateRunOwnership(\n  run: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n  mastra?: {\n    getServer?: () => { auth?: unknown; fga?: unknown } | undefined;\n    getStudio?: () => { fga?: unknown } | undefined;\n  },\n  requestContext?: RequestContext,\n): Promise<void> {\n  if (!run) return;\n  const server = mastra?.getServer?.();\n  const tenancy =\n    typeof (server?.auth as { mapUserToResourceId?: unknown } | undefined)?.mapUserToResourceId === 'function';\n  if (!tenancy) {\n    if (effectiveResourceId && run.resourceId && run.resourceId !== effectiveResourceId) {\n      throw new HTTPException(403, { message: 'Access denied: workflow run belongs to a different resource' });\n    }\n    return;\n  }\n  if (effectiveResourceId) {\n    if (run.resourceId !== effectiveResourceId) {\n      throw new HTTPException(403, { message: 'Access denied: workflow run belongs to a different resource' });\n    }\n    return;\n  }\n  if (!getHandlerFGAProvider(mastra, requestContext)) {\n    throw new HTTPException(403, {\n      message:\n        'Access denied: unscoped workflow run access requires explicit authorization. Configure an FGA provider to authorize privileged run access.',\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,MAAM,uBAAuB;CAC3B,eAAe;CACf,eAAe;CACf,gBAAgB;CAChB,aAAa;CACb,gBAAgB;CAChB,eAAe;CACf,aAAa;CACb,cAAc;CACd,eAAe;CACf,YAAY;CACZ,uBAAuB;CACvB,wBAAwB;CACxB,mBAAmB;CACnB,gBAAgB;AAClB;AAEA,MAAM,kBAAmB,OAAe;AAQxC,MAAa,uBAEX;CAAE,GAAG;CAAsB,GAAI,mBAAmB,CAAC;AAAG;;;;;;;;AC3CxD,SAAgB,sBAAsB,QAAgB,YAA0C;CAC9F,MAAM,YAAY,OAAO,cAAc;CACvC,OACE,OAAO,OAAO,SAAS,CAAC,CAAC,MAAK,aAAY,SAAS,OAAO,UAAU,MACnE,OAAO,OAAO,WAAW,UAAU,IAAI,UAAU,cAAc,KAAA;AAEpE;;;;;;;;;;;;AAaA,SAAgB,sBAAsB,QAAa,gBAA2D;CAC5G,MAAM,YAAY,QAAQ,YAAY,CAAC,EAAE;CACzC,MAAM,YAAY,QAAQ,YAAY,CAAC,EAAE;CAEzC,IAAI,gBAAgB,IAAA,kBAAwB,MAAM,YAAY,WAAW,OAAO;CAChF,IAAI,WAAW,OAAO;CACtB,IAAI,WACF,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,gEAAgE,CAAC;AAG7G;AAGA,SAAgB,aAAa,MAA+B;CAC1D,MAAM,gBAAgB,OAAO,QAAQ,IAAI,CAAC,CAAC,QAAgC,KAAK,CAAC,KAAK,WAAW;EAC/F,IAAI,CAAC,OACH,IAAI,OAAO,aAAa,IAAI;EAE9B,OAAO;CACT,GAAG,CAAC,CAAC;CAEL,IAAI,OAAO,KAAK,aAAa,CAAC,CAAC,SAAS,GACtC,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,OAAO,OAAO,aAAa,CAAC,CAAC,GAAG,CAAC;AAE7E;;;;;;AAOA,SAAgB,aAAa,MAA+B,gBAA0B;CACpF,KAAK,MAAM,OAAO,gBAChB,IAAI,OAAO,MACT,OAAO,KAAK;AAGlB;AAEA,MAAM,0CAA0B,IAAI,IAAI;CACtC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,SAAgB,6BAA6B,MAA+B;CAC1E,MAAM,gBAAgB,KAAK;CAC3B,IAAI,CAAC,iBAAiB,OAAO,kBAAkB,UAAU;CACzD,MAAM,UAAW,cAAwC;CACzD,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU;CAE7C,MAAM,OAAO,OAAO,YAClB,OAAO,QAAQ,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,wBAAwB,IAAI,KAAK,YAAY,CAAC,CAAC,CAC7F;CACA,KAAK,gBAAgB;EAAE,GAAG;EAAe,SAAS;CAAK;AACzD;AAEA,SAAgB,aACd,OACA,eAAuB,KACvB,MAAc,KACE;CAGhB,KAFoB,SAAS,GAAA,CAAI,KAAK,CAAC,CAAC,YAE3B,MAAM,SACjB,OAAO;CAET,MAAM,SAAS,SAAS,SAAS,OAAO,YAAY,GAAG,EAAE;CACzD,IAAI,MAAM,MAAM,GAAG,OAAO;CAC1B,OAAO,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,MAAM,CAAC;AAC1C;;;;AAKA,SAAgB,aAAa,SAA4E;CACvG,IAAI,CAAC,SAAS,OAAO,KAAA;CAErB,OAAO,OAAO,aACX,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO,EAAA,CAAG,KAAK,SAAiB;EACnE,MAAM,CAAC,KAAK,GAAG,cAAc,KAAK,MAAM,GAAG;EAE3C,OAAO,CAAC,KADM,WAAW,KAAK,GACb,CAAC;CACpB,CAAC,CACH;AACF;;;;;;AAOA,SAAgB,wBAAwB,sBAAsC,oBAAmC;CAC/G,IAAI,CAAC,sBAAsB,OAAO,uBAAuB,UACvD;CAGF,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,kBAAkB,GAAG;EAC7D,IAAI,4BAA4B,GAAG,GAAG;EACtC,IAAI,qBAAqB,IAAI,GAAG,MAAM,KAAA,GACpC,qBAAqB,IAAI,KAAK,KAAK;CAEvC;AACF;;;;;AAUA,SAAgB,uBACd,gBACA,kBACoB;CAEpB,OAD0B,gBAAgB,IAAA,oBAA0B,KACxC;AAC9B;;;;;;;AAQA,SAAgB,qBAAqB,gBAAgE;CACnG,OAAO,gBAAgB,IAAI,sBAAsB;AACnD;;;;;;;;AASA,SAAgB,2BACd,qBACuC;CACvC,IAAI,CAAC,qBACH,MAAM,IAAI,cAAc,KAAK,EAC3B,SACE,wLACJ,CAAC;AAEL;;;;;AAMA,SAAgB,qBACd,gBACA,gBACoB;CAEpB,OADwB,gBAAgB,IAAA,kBAAwB,KACtC;AAC5B;;;;;;;AAQA,SAAgB,uBACd,QACA,mBACY;CACZ,IAAI,CAAC,mBAAmB,OAAO;CAC/B,IAAI,UAAU,OAAO,WAAW,UAAU;EACxC,MAAM,EAAE,YAAY,aAAa,GAAG,WAAW;EAC/C,OAAO;GAAE,GAAG;GAAQ,IAAI;EAAkB;CAC5C;CACA,OAAO;AACT;;;;;;AAOA,eAAsB,wBACpB,QACA,qBACe;CACf,IAAI,UAAU,uBAAuB,OAAO,cAAc,OAAO,eAAe,qBAC9E,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,wDAAwD,CAAC;AAErG;;;;;AAMA,eAAsB,oBAAoB,EACxC,QACA,gBACA,UACA,QACA,qBACA,aAAa,qBAAqB,eAQlB;CAChB,MAAM,wBAAwB,QAAQ,mBAAmB;CAEzD,MAAM,cAAc,sBAAsB,QAAQ,cAAc;CAChE,IAAI,CAAC,aACH;CAGF,MAAM,OAAO,gBAAgB,IAAI,MAAM;CACvC,IAAI,CAAC,QAAQ,OAAO,SAAS,UAC3B,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,2DAA2D,CAAC;CAGtG,MAAM,aAAa,eAAe;EAChC;EACM;EACN;EACA,YAAY,QAAQ,cAAc;EAClC;EACA;EACA;CACF,CAAC;AACH;;;;;;;;;;;AAYA,eAAsB,qBACpB,KACA,qBACA,QAIA,gBACe;CACf,IAAI,CAAC,KAAK;CAIV,IAAI,EADF,SAFa,QAAQ,YAAY,EAAA,EAEjB,KAAA,EAAwD,wBAAwB,aACpF;EACZ,IAAI,uBAAuB,IAAI,cAAc,IAAI,eAAe,qBAC9D,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,8DAA8D,CAAC;EAEzG;CACF;CACA,IAAI,qBAAqB;EACvB,IAAI,IAAI,eAAe,qBACrB,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,8DAA8D,CAAC;EAEzG;CACF;CACA,IAAI,CAAC,sBAAsB,QAAQ,cAAc,GAC/C,MAAM,IAAI,cAAc,KAAK,EAC3B,SACE,6IACJ,CAAC;AAEL"}

package/dist/{utils-BnH77wPf.cjs → utils-bQ6Jhog6.cjs}

@@ -1,6 +1,6 @@
 const require_http_exception = require("./http-exception-Co3MbFUf.cjs");
 const require_schema_Bf12g7KC = require("./schema-Bf12g7KC-plP4Ir6h.cjs");
-const require_constants = require("./constants-Co1XjPjd.cjs");
+const require_constants = require("./constants-DMg8hUOR.cjs");
 // ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/711cee35fda0e5a37276180e7a2ecc71bd8bb1528c27c34fa53791b52a3c4054/node_modules/superjson/dist/double-indexed-kv.js
 var DoubleIndexedKV = class {
 	constructor() {
@@ -981,4 +981,4 @@ Object.defineProperty(exports, "toSlug", {
 	}
 });
 
-//# sourceMappingURL=utils-BnH77wPf.cjs.map
+//# sourceMappingURL=utils-bQ6Jhog6.cjs.map