{"record":{"id":"f128f2054dc027ea","repo":"mastra-ai/mastra","slug":"stored-resource-not-found","errorCode":null,"errorMessage":"Stored resource not found","messagePattern":"Stored resource not found","errorType":"http","errorClass":"HTTPException","httpStatus":404,"severity":"error","filePath":"packages/server/src/server/utils.ts","lineNumber":114,"sourceCode":"    return metadata;\n  }\n\n  return {\n    ...(metadata ?? {}),\n    [scope.metadataKey]: scope.value,\n  };\n}\n\nexport function assertStoredResourceScope(\n  resource: StoredResourceLike | null | undefined,\n  scope: StoredResourceScope | undefined,\n): void {\n  if (!resource || !scope) {\n    return;\n  }\n\n  if (resource.metadata?.[scope.metadataKey] !== scope.value) {\n    throw new HTTPException(404, { message: 'Stored resource not found' });\n  }\n}\n\n/**\n * Check if a schema looks like a processor step schema.\n * Processor step schemas are discriminated unions on 'phase' with specific values.\n */\nfunction looksLikeProcessorStepSchema(schema: PublicSchema<unknown> | undefined): boolean {\n  if (!schema) return false;\n\n  try {\n    const jsonSchema = standardSchemaToJSONSchema(toStandardSchema(schema)) as Record<string, unknown> | undefined;\n    if (!jsonSchema) return false;\n\n    // Check for discriminated union pattern: anyOf/oneOf with phase discriminator\n    const variants = (jsonSchema.anyOf || jsonSchema.oneOf) as Array<Record<string, unknown>> | undefined;\n    if (!variants || !Array.isArray(variants)) return false;\n","sourceCodeStart":96,"sourceCodeEnd":132,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/packages/server/src/server/utils.ts#L96-L132","documentation":"After resolving a stored resource (e.g. an agent version), assertStoredResourceScope verifies the resource's metadata matches the caller's resolved resource scope. If the stored resource's scope metadata key does not equal the requested scope value, it throws HTTP 404 so the existence of out-of-scope resources is not revealed. This is an isolation guard against cross-tenant/cross-resource access.","triggerScenarios":"Requesting an agent version whose metadata[scopeKey] differs from the caller's scope value — e.g. GET/ACTIVATE/RESTORE/DELETE on a version id created under a different resource id, or after the caller's resource-id header changed.","commonSituations":"Multi-tenant setups where a client switches tenants but caches old version ids; copying database records between environments without migrating the scope metadata key on stored resources; the caller sending the wrong x-mastra-resource-id for the resource they reference.","solutions":["Send the correct resource id (matching the one the resource was created with) in the request header","Verify the stored record's metadata contains the expected scope key/value (fix data if it was migrated incorrectly)","If the resource genuinely should be accessible, re-create it under the correct scope instead of editing metadata ad hoc"],"exampleFix":"// before\ncurl -H 'x-mastra-resource-id: tenant-2' http://localhost:4111/api/agents/myAgent/versions/v1\n// after\ncurl -H 'x-mastra-resource-id: tenant-1' http://localhost:4111/api/agents/myAgent/versions/v1","handlingStrategy":"type-guard","validationCode":"const scoped = versions.filter(v => v.metadata?.[scopeKey] === myResourceId);\n// only request ids present in `scoped`","typeGuard":"function isVersionInScope(v: { metadata?: Record<string, unknown> }, key: string, value: string): boolean {\n  return v.metadata?.[key] === value;\n}","tryCatchPattern":"try {\n  await activateVersion(id);\n} catch (e) {\n  if (isHttp404(e)) { /* treat as not-visible-in-scope, do not retry */ }\n  else throw e;\n}","preventionTips":["Treat 404 on scoped resources as 'not in your scope', never enumerate other scopes","Keep scope metadata key in sync when copying records between environments","Source version ids from scoped list responses only"],"tags":["http-404","resource-scope","access-control","agent-versions"],"backgroundTag":"cross-tenant-resource-access","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}