@mastra/server 1.82.0 → 1.83.0-alpha.1

package/dist/{agents-DOHGWXDa.cjs → agents-CMEeZr5y.cjs}

@@ -1,15 +1,15 @@
 const require_rolldown_runtime = require("./rolldown-runtime-10nMEhjP.cjs");
-const require_http_exception = require("./http-exception-Co3MbFUf.cjs");
-const require_agents = require("./agents-DbnPZXIN.cjs");
-const require_schema_Bf12g7KC = require("./schema-Bf12g7KC-plP4Ir6h.cjs");
-const require_route_builder = require("./route-builder-CvARmqnA.cjs");
-const require_utils = require("./utils-BhBJHsqX.cjs");
+const require_utils = require("./utils-CL-m2SWZ.cjs");
 const require_constants = require("./constants-DMg8hUOR.cjs");
-const require_server_handlers_error = require("./server/handlers/error.cjs");
-const require_utils$1 = require("./utils-9PRHHTGC.cjs");
-const require_stored_agents = require("./stored-agents-TQ2lIFbx.cjs");
+const require_schema_Bf12g7KC = require("./schema-Bf12g7KC-C5XzpQxe.cjs");
+const require_utils$1 = require("./utils-BXEJ6FZC.cjs");
+const require_http_exception = require("./http-exception-Co3MbFUf.cjs");
+const require_agents = require("./agents-CjcvdF2e.cjs");
+const require_stored_agents = require("./stored-agents-m0Knvv29.cjs");
 const require_workspace = require("./workspace-C5BBUatQ.cjs");
+const require_route_builder = require("./route-builder-DHqDrSSy.cjs");
 const require_server_handlers_authorship = require("./server/handlers/authorship.cjs");
+const require_server_handlers_error = require("./server/handlers/error.cjs");
 const require_server_handlers_tool_schema_overrides = require("./server/handlers/tool-schema-overrides.cjs");
 let zod_v4 = require("zod/v4");
 let _mastra_core_utils_zod_to_json = require("@mastra/core/utils/zod-to-json");
@@ -23,6 +23,7 @@ let _mastra_core_llm = require("@mastra/core/llm");
 // src/server/utils/agent-stream-events.ts
 function toAgentStreamChunks(event) {
 	const { runId } = event;
+	const logIndex = typeof event.index === "number" ? { index: event.index } : void 0;
 	const abort = {
 		type: "abort",
 		runId,
@@ -30,10 +31,21 @@ function toAgentStreamChunks(event) {
 		payload: {}
 	};
 	switch (event.type) {
-		case "chunk": return [event.data];
+		case "chunk": {
+			const { index: _nestedIndex, ...data } = event.data;
+			return [{
+				...data,
+				...logIndex
+			}];
+		}
 		case "step-start": {
 			const chunk = event.data;
-			return chunk && "type" in chunk ? [chunk] : [];
+			if (!chunk || !("type" in chunk)) return [];
+			const { index: _nestedIndex, ...data } = chunk;
+			return [{
+				...data,
+				...logIndex
+			}];
 		}
 		case "finish": {
 			const data = event.data;
@@ -49,6 +61,7 @@ function toAgentStreamChunks(event) {
 				type: "finish",
 				runId,
 				from: _mastra_core_stream.ChunkFrom.AGENT,
+				...logIndex,
 				payload: {
 					output: raw === void 0 ? data.output : {
 						...data.output,
@@ -69,6 +82,7 @@ function toAgentStreamChunks(event) {
 				type: "finish",
 				runId,
 				from: _mastra_core_stream.ChunkFrom.AGENT,
+				...logIndex,
 				payload: {
 					output: {
 						text: data.text,
@@ -87,10 +101,14 @@ function toAgentStreamChunks(event) {
 				}
 			}];
 		}
-		case "error": return [{
-			type: "error",
-			payload: { error: { ...event.data.error } }
-		}];
+		case "error": {
+			const data = event.data;
+			return [{
+				type: "error",
+				...logIndex,
+				payload: { error: { ...data.error } }
+			}];
+		}
 		default: return [];
 	}
 }
@@ -247,6 +265,12 @@ function hasSuspendedToolCall(snapshot, toolCallId) {
 	};
 	return visit(snapshot.context);
 }
+/** A run-log entry that ends the run. An error *chunk* can precede the finish, so it does not count. */
+const isRunTerminalEvent = (event) => {
+	if (event?.type === "error") return true;
+	const type = event?.type === "chunk" ? event.data?.type : event?.type;
+	return type === "finish" || type === "abort";
+};
 const DURABLE_SNAPSHOT_WAIT_TIMEOUT_MS = 1e4;
 const DURABLE_SNAPSHOT_WAIT_INTERVAL_MS = 25;
 function getDurableLoopWorkflowName(agent) {
@@ -299,6 +323,50 @@ async function validateDurableToolCallAccess({ mastra, agent, runId, toolCallId,
 */
 const ALIASED_API_KEY_ENV_VAR_PROVIDERS = /* @__PURE__ */ new Set(["google"]);
 /**
+* The shared ownership record of a plain agent run, readable from any server
+* sharing the agent's record cache. Undefined when the run is unknown or
+* expired. Falls back to the owner of a run executing in this process on a
+* core without shared records. A record cache that cannot be read is a 503:
+* the caller is refused, never let through.
+*/
+async function getPlainRunRecord(agent, runId) {
+	const resumable = agent;
+	if (typeof resumable.__getRunRecord === "function") try {
+		return await resumable.__getRunRecord.call(agent, runId);
+	} catch {
+		throw new require_http_exception.HTTPException(503, { message: "Run ownership is temporarily unavailable" });
+	}
+	const owner = resumable.__getPublishedRunOwner?.call(agent, runId);
+	return owner ? {
+		...owner,
+		status: "running"
+	} : void 0;
+}
+/** The caller must own the run and have `permission` on its thread. */
+async function authorizeRunOwner({ mastra, agent, owner, requestContext, permission }) {
+	await require_utils$1.validateRunOwnership(owner, require_utils$1.getContextResourceId(requestContext), mastra, requestContext);
+	if (!owner.threadId) return;
+	const thread = await (await agent.getMemory({ requestContext }))?.getThreadById({ threadId: owner.threadId });
+	await require_utils$1.enforceThreadAccess({
+		mastra,
+		requestContext,
+		threadId: owner.threadId,
+		thread,
+		effectiveResourceId: require_utils$1.getContextResourceId(requestContext),
+		permission
+	});
+}
+/** Whether the agent publishes its runs, so a closed HTTP reader can detach instead of aborting. */
+function hasResumableStreams(agent) {
+	if ((0, _mastra_core_agent.isDurableAgentLike)(agent)) return true;
+	const resumable = agent;
+	return typeof resumable.hasResumableStreams === "function" && resumable.hasResumableStreams();
+}
+/** The bus a plain Agent with resumable streams publishes its runs on. */
+function getAgentStreamPubSub(agent) {
+	return agent.__getStreamBus?.()?.pubsub;
+}
+/**
 * Checks if a provider has its required API key environment variable(s) configured.
 * Handles provider IDs with suffixes (e.g., "openai.chat" -> "openai").
 * Also handles custom gateway providers that are stored with gateway prefix (e.g., "acme/acme-openai").
@@ -1432,8 +1500,8 @@ const STREAM_GENERATE_ROUTE = require_route_builder.createRoute({
 				...restOptions,
 				requestContext: serverRequestContext,
 				memory: authorizedMemoryOption,
-				abortSignal: (0, _mastra_core_agent.isDurableAgentLike)(agent) ? void 0 : abortSignal,
-				_detachObserverOnCancel: (0, _mastra_core_agent.isDurableAgentLike)(agent)
+				abortSignal: hasResumableStreams(agent) ? void 0 : abortSignal,
+				_detachObserverOnCancel: hasResumableStreams(agent)
 			};
 			if (untilIdle) options.untilIdle = untilIdle;
 			return (structuredOutput ? await agent.stream(messages, {
@@ -1690,6 +1758,91 @@ const QUEUE_AGENT_SIGNAL_ROUTE = require_route_builder.createRoute({
 		}
 	}
 });
+/**
+* Authorizes a request against a durable run through its workflow rows: the
+* caller must own the run, the run must belong to `agent`, and the caller must
+* have `permission` on its thread. Throws 403 when access is denied.
+* Returns 'missing' when no row exists and 'unverified' when the run has not
+* checkpointed its input yet, so ownership cannot be confirmed.
+*/
+async function authorizeDurableRun({ mastra, agent, runId, requestContext, permission }) {
+	const workflows = await mastra.getStorage()?.getStore("workflows");
+	const run = await workflows?.getWorkflowRunById({
+		workflowName: getDurableLoopWorkflowName(agent),
+		runId
+	});
+	if (!run) return "missing";
+	await require_utils$1.validateRunOwnership(run, require_utils$1.getContextResourceId(requestContext), mastra, requestContext);
+	const ownershipSchema = zod_v4.z.object({ context: zod_v4.z.object({ input: zod_v4.z.object({
+		agentId: zod_v4.z.string(),
+		state: zod_v4.z.object({ threadId: zod_v4.z.string().optional() }).optional()
+	}) }) });
+	let parsed = ownershipSchema.safeParse(typeof run.snapshot === "string" ? JSON.parse(run.snapshot) : run.snapshot);
+	if (!parsed.success) {
+		const execution = await workflows?.getWorkflowRunById({
+			workflowName: getDurableLoopWorkflowName(agent).replace(_mastra_core_agent_durable.DurableStepIds.AGENTIC_LOOP, _mastra_core_agent_durable.DurableStepIds.AGENTIC_EXECUTION),
+			runId
+		});
+		await require_utils$1.validateRunOwnership(execution, require_utils$1.getContextResourceId(requestContext), mastra, requestContext);
+		parsed = ownershipSchema.safeParse(typeof execution?.snapshot === "string" ? JSON.parse(execution.snapshot) : execution?.snapshot);
+	}
+	if (!parsed.success) return "unverified";
+	if (parsed.data.context.input.agentId !== agent.id) throw new require_http_exception.HTTPException(403, { message: "Access denied: run does not belong to this agent" });
+	const threadId = parsed.data.context.input.state?.threadId;
+	if (threadId) {
+		const thread = await (await agent.getMemory({ requestContext }))?.getThreadById({ threadId });
+		await require_utils$1.enforceThreadAccess({
+			mastra,
+			requestContext,
+			threadId,
+			thread,
+			effectiveResourceId: require_utils$1.getContextResourceId(requestContext),
+			permission
+		});
+	}
+	return "ok";
+}
+/**
+* Authorizes observing a run: the caller must own it and have read access to
+* its thread. Plain agent runs are checked against their shared run record,
+* so any server sharing the agent's record cache can authorize them. Durable
+* runs use the owner the agent tracks in this process, then their workflow
+* rows. Throws 404 when the run cannot be found or verified.
+*/
+async function authorizeRunObservation({ mastra, agent, runId, requestContext }) {
+	const permission = require_utils$1.MastraFGAPermissions.MEMORY_READ;
+	if (!(0, _mastra_core_agent.isDurableAgentLike)(agent)) {
+		const record = await getPlainRunRecord(agent, runId);
+		if (!record) throw new require_http_exception.HTTPException(404, { message: "Run not found" });
+		await authorizeRunOwner({
+			mastra,
+			agent,
+			owner: record,
+			requestContext,
+			permission
+		});
+		return;
+	}
+	const getOwner = agent.__getRunOwner;
+	const owner = typeof getOwner === "function" ? getOwner.call(agent, runId) : void 0;
+	if (owner) {
+		await authorizeRunOwner({
+			mastra,
+			agent,
+			owner,
+			requestContext,
+			permission
+		});
+		return;
+	}
+	if (await authorizeDurableRun({
+		mastra,
+		agent,
+		runId,
+		requestContext,
+		permission
+	}) !== "ok") throw new require_http_exception.HTTPException(404, { message: "Run not found" });
+}
 const ABORT_AGENT_RUN_ROUTE = require_route_builder.createRoute({
 	method: "POST",
 	path: "/agents/:agentId/runs/:runId/abort",
@@ -1697,7 +1850,7 @@ const ABORT_AGENT_RUN_ROUTE = require_route_builder.createRoute({
 	pathParamSchema: require_agents.agentRunPathParams,
 	responseSchema: require_agents.abortAgentThreadResponseSchema,
 	summary: "Abort an agent run",
-	description: "Explicitly stop a durable run, including runs without a memory thread",
+	description: "Explicitly stop a durable run or a run of an agent with resumable streams, including runs without a memory thread",
 	tags: ["Agents"],
 	requiresAuth: true,
 	requiresPermission: require_utils$1.MastraFGAPermissions.AGENTS_EXECUTE,
@@ -1708,41 +1861,29 @@ const ABORT_AGENT_RUN_ROUTE = require_route_builder.createRoute({
 				agentId,
 				requestContext
 			});
-			if (!(0, _mastra_core_agent.isDurableAgentLike)(agent)) throw new require_http_exception.HTTPException(501, { message: "Run-scoped cancellation requires a durable agent" });
-			const workflows = await mastra.getStorage()?.getStore("workflows");
-			const run = await workflows?.getWorkflowRunById({
-				workflowName: getDurableLoopWorkflowName(agent),
-				runId
-			});
-			if (!run) return { aborted: false };
-			await require_utils$1.validateRunOwnership(run, require_utils$1.getContextResourceId(requestContext), mastra, requestContext);
-			const ownershipSchema = zod_v4.z.object({ context: zod_v4.z.object({ input: zod_v4.z.object({
-				agentId: zod_v4.z.string(),
-				state: zod_v4.z.object({ threadId: zod_v4.z.string().optional() }).optional()
-			}) }) });
-			let parsed = ownershipSchema.safeParse(typeof run.snapshot === "string" ? JSON.parse(run.snapshot) : run.snapshot);
-			if (!parsed.success) {
-				const execution = await workflows?.getWorkflowRunById({
-					workflowName: getDurableLoopWorkflowName(agent).replace(_mastra_core_agent_durable.DurableStepIds.AGENTIC_LOOP, _mastra_core_agent_durable.DurableStepIds.AGENTIC_EXECUTION),
-					runId
-				});
-				await require_utils$1.validateRunOwnership(execution, require_utils$1.getContextResourceId(requestContext), mastra, requestContext);
-				parsed = ownershipSchema.safeParse(typeof execution?.snapshot === "string" ? JSON.parse(execution.snapshot) : execution?.snapshot);
-			}
-			if (!parsed.success) return { aborted: false };
-			if (parsed.data.context.input.agentId !== agent.id) throw new require_http_exception.HTTPException(403, { message: "Access denied: run does not belong to this agent" });
-			const threadId = parsed.data.context.input.state?.threadId;
-			if (threadId) {
-				const thread = await (await agent.getMemory({ requestContext }))?.getThreadById({ threadId });
-				await require_utils$1.enforceThreadAccess({
+			if (!(0, _mastra_core_agent.isDurableAgentLike)(agent)) {
+				const resumable = agent;
+				if (typeof resumable.__getRunRecord !== "function" && typeof resumable.__getPublishedRunOwner !== "function" || !hasResumableStreams(agent)) throw new require_http_exception.HTTPException(501, { message: "Run-scoped cancellation requires a durable agent or an agent with resumable streams" });
+				const record = await getPlainRunRecord(agent, runId);
+				if (!record) throw new require_http_exception.HTTPException(404, { message: "Run not found" });
+				await authorizeRunOwner({
 					mastra,
+					agent,
+					owner: record,
 					requestContext,
-					threadId,
-					thread,
-					effectiveResourceId: require_utils$1.getContextResourceId(requestContext),
 					permission: require_utils$1.MastraFGAPermissions.MEMORY_WRITE
 				});
+				if (record.status === "finished") return { aborted: false };
+				if (typeof resumable.__abortRunAcknowledged === "function") return { aborted: await resumable.__abortRunAcknowledged.call(agent, runId) };
+				return { aborted: agent.abortRunStream(runId) };
 			}
+			if (await authorizeDurableRun({
+				mastra,
+				agent,
+				runId,
+				requestContext,
+				permission: require_utils$1.MastraFGAPermissions.MEMORY_WRITE
+			}) !== "ok") return { aborted: false };
 			if (typeof agent.__abortRunAcknowledged === "function") return { aborted: await agent.__abortRunAcknowledged(runId) };
 			return { aborted: await agent.abortRunStream(runId) };
 		} catch (error) {
@@ -2005,8 +2146,8 @@ const STREAM_UNTIL_IDLE_GENERATE_ROUTE = require_route_builder.createRoute({
 				context: restOptions.context,
 				requestContext: serverRequestContext,
 				memory: authorizedMemoryOption,
-				abortSignal: (0, _mastra_core_agent.isDurableAgentLike)(agent) ? void 0 : abortSignal,
-				_detachObserverOnCancel: (0, _mastra_core_agent.isDurableAgentLike)(agent)
+				abortSignal: hasResumableStreams(agent) ? void 0 : abortSignal,
+				_detachObserverOnCancel: hasResumableStreams(agent)
 			};
 			return (structuredOutput ? await agent.streamUntilIdle(messages, {
 				...options,
@@ -2040,24 +2181,43 @@ const OBSERVE_AGENT_STREAM_ROUTE = require_route_builder.createRoute({
 	bodySchema: require_agents.observeAgentBodySchema,
 	responseSchema: require_agents.observeAgentResponseSchema,
 	summary: "Observe agent stream",
-	description: "Reconnect to an existing agent stream to receive missed events. Supports position-based resume with offset for efficient reconnection.",
+	description: "Reconnect to an existing agent stream to receive missed events. Every frame except abort carries the run-log `index` it came from; pass `offset` as the index + 1 of the last frame that has one to resume without repeating indexed frames. Frames whose replay-cache write failed, or all frames when caching is off, carry no index, so no offset can resume at them; omitting `offset` replays whatever the transport itself retains, which can repeat frames already received.",
 	tags: ["Agents", "Streaming"],
 	requiresAuth: true,
-	handler: async ({ mastra, agentId, runId, offset, abortSignal }) => {
+	handler: async ({ mastra, agentId, runId, offset, abortSignal, requestContext }) => {
 		try {
 			const agent = await getAgentFromSystem({
 				mastra,
-				agentId
+				agentId,
+				requestContext
+			});
+			await authorizeRunObservation({
+				mastra,
+				agent,
+				runId,
+				requestContext
 			});
 			const durableAgent = (0, _mastra_core_agent.isDurableAgentLike)(agent) ? agent : void 0;
-			const pubsub = durableAgent?.pubsub ?? mastra.pubsub;
+			const pubsub = durableAgent?.pubsub ?? getAgentStreamPubSub(agent) ?? mastra.pubsub;
 			const topic = (0, _mastra_core_agent_durable.AGENT_STREAM_TOPIC)(runId);
 			const subscribe = (onEvent, onComplete) => {
 				if (typeof durableAgent?.__subscribeToRunStream === "function") return durableAgent.__subscribeToRunStream(runId, {
 					offset,
 					onComplete
 				}, onEvent);
-				return (offset !== void 0 ? pubsub.subscribeFromOffset(topic, offset, onEvent) : pubsub.subscribeWithReplay(topic, onEvent)).then(() => () => pubsub.unsubscribe(topic, onEvent));
+				if (offset === void 0) return pubsub.subscribeWithReplay(topic, onEvent).then(() => () => pubsub.unsubscribe(topic, onEvent));
+				return pubsub.subscribeFromOffset(topic, offset, onEvent).then(() => {
+					if (offset > 0) {
+						const readTail = async () => {
+							const window = await pubsub.getHistory(topic, offset - 1);
+							return window.length > 0 ? window.at(-1) : (await pubsub.getHistory(topic, 0)).at(-1);
+						};
+						readTail().catch(() => void 0).then((last) => {
+							if (typeof last?.index === "number" && last.index < offset && isRunTerminalEvent(last)) onComplete();
+						});
+					}
+					return () => pubsub.unsubscribe(topic, onEvent);
+				});
 			};
 			let closed = false;
 			let pendingRejection;
@@ -2186,8 +2346,8 @@ const APPROVE_TOOL_CALL_ROUTE = require_route_builder.createRoute({
 			return (await agent.approveToolCall({
 				...params,
 				requestContext,
-				abortSignal: (0, _mastra_core_agent.isDurableAgentLike)(agent) ? void 0 : abortSignal,
-				_detachObserverOnCancel: (0, _mastra_core_agent.isDurableAgentLike)(agent)
+				abortSignal: hasResumableStreams(agent) ? void 0 : abortSignal,
+				_detachObserverOnCancel: hasResumableStreams(agent)
 			})).fullStream;
 		} catch (error) {
 			return require_server_handlers_error.handleError(error, "error approving tool call");
@@ -2343,8 +2503,8 @@ const DECLINE_TOOL_CALL_ROUTE = require_route_builder.createRoute({
 			return (await agent.declineToolCall({
 				...params,
 				requestContext,
-				abortSignal: (0, _mastra_core_agent.isDurableAgentLike)(agent) ? void 0 : abortSignal,
-				_detachObserverOnCancel: (0, _mastra_core_agent.isDurableAgentLike)(agent)
+				abortSignal: hasResumableStreams(agent) ? void 0 : abortSignal,
+				_detachObserverOnCancel: hasResumableStreams(agent)
 			})).fullStream;
 		} catch (error) {
 			return require_server_handlers_error.handleError(error, "error declining tool call");
@@ -2428,8 +2588,8 @@ const RESUME_STREAM_ROUTE = require_route_builder.createRoute({
 				...restOptions,
 				requestContext: serverRequestContext,
 				memory: authorizedMemoryOption,
-				abortSignal: (0, _mastra_core_agent.isDurableAgentLike)(agent) ? void 0 : abortSignal,
-				_detachObserverOnCancel: (0, _mastra_core_agent.isDurableAgentLike)(agent)
+				abortSignal: hasResumableStreams(agent) ? void 0 : abortSignal,
+				_detachObserverOnCancel: hasResumableStreams(agent)
 			};
 			if (untilIdle) options.untilIdle = untilIdle;
 			return (structuredOutput ? await agent.resumeStream(resumeData, {
@@ -2558,8 +2718,8 @@ const RESUME_STREAM_UNTIL_IDLE_ROUTE = require_route_builder.createRoute({
 				context: restOptions.context,
 				requestContext: serverRequestContext,
 				memory: authorizedMemoryOption,
-				abortSignal: (0, _mastra_core_agent.isDurableAgentLike)(agent) ? void 0 : abortSignal,
-				_detachObserverOnCancel: (0, _mastra_core_agent.isDurableAgentLike)(agent)
+				abortSignal: hasResumableStreams(agent) ? void 0 : abortSignal,
+				_detachObserverOnCancel: hasResumableStreams(agent)
 			};
 			return (structuredOutput ? await agent.resumeStreamUntilIdle(resumeData, {
 				...options,
@@ -3381,4 +3541,4 @@ Object.defineProperty(exports, "isProviderConnected", {
 	}
 });
 
-//# sourceMappingURL=agents-DOHGWXDa.cjs.map
+//# sourceMappingURL=agents-CMEeZr5y.cjs.map