@mastra/ai-sdk 1.5.0 → 1.5.1-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @mastra/ai-sdk
 
+## 1.5.1-alpha.0
+
+### Patch Changes
+
+- `workflowRoute` now uses `MASTRA_RESOURCE_ID_KEY` from `requestContext` (set by server middleware) as the `resourceId` when creating a workflow run, falling back to the client-supplied value. This matches the precedence contract already enforced in agent calls. ([#18315](https://github.com/mastra-ai/mastra/pull/18315))
+
+- Security: error responses from `chatRoute` and `handleChatStream` no longer leak the agent's system prompt back to the client when an upstream LLM call fails. The default error serializer now strips sensitive payload fields before they reach the response stream. ([#18335](https://github.com/mastra-ai/mastra/pull/18335))
+
+  `chatRoute` also accepts an optional `onError` for callers that want richer diagnostics on a trusted surface:
+
+  ```ts
+  chatRoute({
+    agent: 'support-agent',
+    onError: error => JSON.stringify(error), // full payload — only safe on trusted surfaces
+  });
+  ```
+
+- Updated dependencies [[`65f255a`](https://github.com/mastra-ai/mastra/commit/65f255a38667beb6ceeadabfa9eb5059bfec8298), [`4a88c6e`](https://github.com/mastra-ai/mastra/commit/4a88c6e2bdce316f8d7551b4ec3449b0b06fc71c), [`87a17ef`](https://github.com/mastra-ai/mastra/commit/87a17efbd725aca6639febdc5e69e2abb3048689), [`e11ff30`](https://github.com/mastra-ai/mastra/commit/e11ff301408bf1731dca2fb7fbfcd8c819500a35), [`9d2c946`](https://github.com/mastra-ai/mastra/commit/9d2c946d0859e90ae4bcec5beeb1da7398d2ad1e), [`f1ec385`](https://github.com/mastra-ai/mastra/commit/f1ec385386f62b1a0847ec5353ae2bb169d1c3d9), [`e14986f`](https://github.com/mastra-ai/mastra/commit/e14986f6e5478d6384d04ff9a7f9a79a46a8b529), [`0be490f`](https://github.com/mastra-ai/mastra/commit/0be490fabb538c5a7de796ea0aff7d04a0bea1f3), [`0be490f`](https://github.com/mastra-ai/mastra/commit/0be490fabb538c5a7de796ea0aff7d04a0bea1f3), [`974f614`](https://github.com/mastra-ai/mastra/commit/974f614e083bd68278536f94453f7b320b86a3c7), [`31be1cf`](https://github.com/mastra-ai/mastra/commit/31be1cf5f2a7b5eef12f6123a40653b4d8115c16)]:
+  - @mastra/core@1.46.0-alpha.3
+
 ## 1.5.0
 
 ### Minor Changes

package/dist/chat-route.d.ts

@@ -94,6 +94,7 @@ export type chatRouteOptions<OUTPUT = undefined> = {
     sendFinish?: boolean;
     sendReasoning?: boolean;
     sendSources?: boolean;
+    onError?: (error: unknown) => string;
 };
 /**
  * Creates a chat route handler for streaming agent conversations using the AI SDK format.
@@ -108,6 +109,7 @@ export type chatRouteOptions<OUTPUT = undefined> = {
  * @param {boolean} [options.sendFinish=true] - Whether to send finish events in the stream
  * @param {boolean} [options.sendReasoning=false] - Whether to include reasoning steps in the stream
  * @param {boolean} [options.sendSources=false] - Whether to include source citations in the stream
+ * @param {(error: unknown) => string} [options.onError] - Custom error serializer streamed to the client. When omitted, errors are passed through a default serializer that strips sensitive fields (e.g. `APICallError.requestBodyValues`, which holds the system prompt) before they reach the client.
  *
  * @returns {ReturnType<typeof registerApiRoute>} A registered API route handler
  *
@@ -138,6 +140,6 @@ export type chatRouteOptions<OUTPUT = undefined> = {
  * - If both `agent` and `:agentId` are present, a warning is logged and the fixed `agent` takes precedence
  * - Request context from the incoming request overrides `defaultOptions.requestContext` if both are present
  */
-export declare function chatRoute<OUTPUT = undefined>({ path, agent, defaultOptions, version, agentVersion, sendStart, sendFinish, sendReasoning, sendSources, }: chatRouteOptions<OUTPUT>): ReturnType<typeof registerApiRoute>;
+export declare function chatRoute<OUTPUT = undefined>({ path, agent, defaultOptions, version, agentVersion, sendStart, sendFinish, sendReasoning, sendSources, onError, }: chatRouteOptions<OUTPUT>): ReturnType<typeof registerApiRoute>;
 export {};
 //# sourceMappingURL=chat-route.d.ts.map

package/dist/chat-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chat-route.d.ts","sourceRoot":"","sources":["../src/chat-route.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,sBAAsB,IAAI,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAM9F,OAAO,KAAK,EAAE,sBAAsB,IAAI,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC1F,OAAO,KAAK,EAAE,qBAAqB,EAA6B,MAAM,oBAAoB,CAAC;AAC3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGvD,OAAO,KAAK,EACV,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAExB;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,WAAW,EAAE,GACtB;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA2B/D;AAED,MAAM,MAAM,uBAAuB,CACjC,UAAU,SAAS,kBAAkB,GAAG,kBAAkB,EAC1D,MAAM,GAAG,SAAS,IAChB,qBAAqB,CAAC,MAAM,CAAC,GAAG;IAClC,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjC,kEAAkE;IAClE,OAAO,CAAC,EAAE,gBAAgB,GAAG,oBAAoB,CAAC;CACnD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAErF,MAAM,MAAM,wBAAwB,CAAC,UAAU,SAAS,kBAAkB,GAAG,kBAAkB,EAAE,MAAM,GAAG,SAAS,IAAI;IACrH,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,MAAM,EAAE,uBAAuB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACpD,cAAc,CAAC,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IACrC,eAAe,CAAC,EAAE,UAAU,SAAS,WAAW,GAC5C,wBAAwB,CAAC,UAAU,CAAC,CAAC,iBAAiB,CAAC,GACvD,UAAU,SAAS,WAAW,GAC5B,wBAAwB,CAAC,UAAU,CAAC,CAAC,iBAAiB,CAAC,GACvD,KAAK,CAAC;CACb,CAAC;AAEF,KAAK,0BAA0B,CAAC,UAAU,SAAS,WAAW,GAAG,WAAW,EAAE,MAAM,GAAG,SAAS,IAAI,IAAI,CACtG,wBAAwB,CAAC,UAAU,EAAE,MAAM,CAAC,EAC5C,SAAS,GAAG,iBAAiB,CAC9B,GAAG;IACF,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,eAAe,CAAC,EAAE,wBAAwB,CAAC,UAAU,CAAC,CAAC,iBAAiB,CAAC,CAAC;CAC3E,CAAC;AAEF,KAAK,0BAA0B,CAAC,UAAU,SAAS,WAAW,GAAG,WAAW,EAAE,MAAM,GAAG,SAAS,IAAI,IAAI,CACtG,wBAAwB,CAAC,UAAU,EAAE,MAAM,CAAC,EAC5C,SAAS,GAAG,iBAAiB,CAC9B,GAAG;IACF,OAAO,EAAE,IAAI,CAAC;IACd,eAAe,CAAC,EAAE,wBAAwB,CAAC,UAAU,CAAC,CAAC,iBAAiB,CAAC,CAAC;CAC3E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,SAAS,WAAW,GAAG,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/F,OAAO,EAAE,0BAA0B,CAAC,UAAU,EAAE,MAAM,CAAC,GACtD,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;AAC1C,wBAAgB,gBAAgB,CAAC,UAAU,SAAS,WAAW,GAAG,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/F,OAAO,EAAE,0BAA0B,CAAC,UAAU,EAAE,MAAM,CAAC,GACtD,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;AAwH1C,MAAM,MAAM,gBAAgB,CAAC,MAAM,GAAG,SAAS,IAAI;IACjD,cAAc,CAAC,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACpC,GAAG,CACA;IACE,IAAI,EAAE,GAAG,MAAM,WAAW,MAAM,EAAE,CAAC;IACnC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,CACJ,GAAG;IACA,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,SAAS,CAAC,MAAM,GAAG,SAAS,EAAE,EAC5C,IAAuB,EACvB,KAAK,EACL,cAAc,EACd,OAAc,EACd,YAAY,EACZ,SAAgB,EAChB,UAAiB,EACjB,aAAqB,EACrB,WAAmB,GACpB,EAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAkNhE"}
+{"version":3,"file":"chat-route.d.ts","sourceRoot":"","sources":["../src/chat-route.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,sBAAsB,IAAI,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAM9F,OAAO,KAAK,EAAE,sBAAsB,IAAI,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC1F,OAAO,KAAK,EAAE,qBAAqB,EAA6B,MAAM,oBAAoB,CAAC;AAC3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGvD,OAAO,KAAK,EACV,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAExB;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,WAAW,EAAE,GACtB;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA2B/D;AAED,MAAM,MAAM,uBAAuB,CACjC,UAAU,SAAS,kBAAkB,GAAG,kBAAkB,EAC1D,MAAM,GAAG,SAAS,IAChB,qBAAqB,CAAC,MAAM,CAAC,GAAG;IAClC,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjC,kEAAkE;IAClE,OAAO,CAAC,EAAE,gBAAgB,GAAG,oBAAoB,CAAC;CACnD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAErF,MAAM,MAAM,wBAAwB,CAAC,UAAU,SAAS,kBAAkB,GAAG,kBAAkB,EAAE,MAAM,GAAG,SAAS,IAAI;IACrH,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,MAAM,EAAE,uBAAuB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACpD,cAAc,CAAC,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IACrC,eAAe,CAAC,EAAE,UAAU,SAAS,WAAW,GAC5C,wBAAwB,CAAC,UAAU,CAAC,CAAC,iBAAiB,CAAC,GACvD,UAAU,SAAS,WAAW,GAC5B,wBAAwB,CAAC,UAAU,CAAC,CAAC,iBAAiB,CAAC,GACvD,KAAK,CAAC;CACb,CAAC;AAEF,KAAK,0BAA0B,CAAC,UAAU,SAAS,WAAW,GAAG,WAAW,EAAE,MAAM,GAAG,SAAS,IAAI,IAAI,CACtG,wBAAwB,CAAC,UAAU,EAAE,MAAM,CAAC,EAC5C,SAAS,GAAG,iBAAiB,CAC9B,GAAG;IACF,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,eAAe,CAAC,EAAE,wBAAwB,CAAC,UAAU,CAAC,CAAC,iBAAiB,CAAC,CAAC;CAC3E,CAAC;AAEF,KAAK,0BAA0B,CAAC,UAAU,SAAS,WAAW,GAAG,WAAW,EAAE,MAAM,GAAG,SAAS,IAAI,IAAI,CACtG,wBAAwB,CAAC,UAAU,EAAE,MAAM,CAAC,EAC5C,SAAS,GAAG,iBAAiB,CAC9B,GAAG;IACF,OAAO,EAAE,IAAI,CAAC;IACd,eAAe,CAAC,EAAE,wBAAwB,CAAC,UAAU,CAAC,CAAC,iBAAiB,CAAC,CAAC;CAC3E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,SAAS,WAAW,GAAG,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/F,OAAO,EAAE,0BAA0B,CAAC,UAAU,EAAE,MAAM,CAAC,GACtD,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;AAC1C,wBAAgB,gBAAgB,CAAC,UAAU,SAAS,WAAW,GAAG,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/F,OAAO,EAAE,0BAA0B,CAAC,UAAU,EAAE,MAAM,CAAC,GACtD,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;AAwH1C,MAAM,MAAM,gBAAgB,CAAC,MAAM,GAAG,SAAS,IAAI;IACjD,cAAc,CAAC,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACpC,GAAG,CACA;IACE,IAAI,EAAE,GAAG,MAAM,WAAW,MAAM,EAAE,CAAC;IACnC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,CACJ,GAAG;IACA,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;CACtC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,wBAAgB,SAAS,CAAC,MAAM,GAAG,SAAS,EAAE,EAC5C,IAAuB,EACvB,KAAK,EACL,cAAc,EACd,OAAc,EACd,YAAY,EACZ,SAAgB,EAChB,UAAiB,EACjB,aAAqB,EACrB,WAAmB,EACnB,OAAO,GACR,EAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAmNhE"}

package/dist/index.cjs

@@ -6,6 +6,7 @@ var zod = require('zod');
 var server = require('@mastra/core/server');
 var web = require('stream/web');
 var stream = require('@mastra/core/stream');
+var requestContext = require('@mastra/core/request-context');
 var agent = require('@mastra/core/agent');
 var di = require('@mastra/core/di');
 var processors = require('@mastra/core/processors');
@@ -30,7 +31,7 @@ function _interopNamespace(e) {
 
 var z4__namespace = /*#__PURE__*/_interopNamespace(z4);
 
-// ../../packages/_vendored/ai_v5/dist/chunk-OMTTDYJT.js
+// ../../packages/_vendored/ai_v5/dist/chunk-I2JBSJEA.js
 var marker = "vercel.ai.error";
 var symbol = Symbol.for(marker);
 var _a;
@@ -12049,13 +12050,14 @@ var isMastraTextStreamChunk = (chunk) => {
     "raw"
   ].includes(chunk.type);
 };
+var REDACTED_ERROR_FIELDS = /* @__PURE__ */ new Set(["requestBodyValues", "responseBody", "responseHeaders", "data", "prompt"]);
 function safeParseErrorObject(obj) {
   if (typeof obj !== "object" || obj === null) {
     return String(obj);
   }
   try {
-    const stringified = JSON.stringify(obj);
-    if (stringified === "{}") {
+    const stringified = JSON.stringify(obj, (key, value) => REDACTED_ERROR_FIELDS.has(key) ? void 0 : value);
+    if (stringified === "{}" || stringified === void 0) {
       return String(obj);
     }
     return stringified;
@@ -14002,7 +14004,8 @@ function chatRoute({
   sendStart = true,
   sendFinish = true,
   sendReasoning = false,
-  sendSources = false
+  sendSources = false,
+  onError
 }) {
   if (!agent && !path.includes("/:agentId")) {
     throw new Error("Path must include :agentId to route to the correct agent or pass the agent explicitly");
@@ -14171,7 +14174,8 @@ function chatRoute({
         sendStart,
         sendFinish,
         sendReasoning,
-        sendSources
+        sendSources,
+        onError
       };
       if (version === "v6") {
         const uiMessageStream2 = await handleChatStream({
@@ -14194,13 +14198,23 @@ async function handleWorkflowStream({
   sendReasoning = false,
   sendSources = false
 }) {
-  const { runId, resourceId, inputData, initialState, resumeData, requestContext, ...rest } = params;
+  const {
+    runId,
+    resourceId: resourceIdFromParams,
+    inputData,
+    initialState,
+    resumeData,
+    requestContext: requestContext$1,
+    ...rest
+  } = params;
+  const resourceIdFromContext = requestContext$1?.get(requestContext.MASTRA_RESOURCE_ID_KEY);
+  const resourceId = resourceIdFromContext ?? resourceIdFromParams;
   const workflowObj = mastra.getWorkflowById(workflowId);
   if (!workflowObj) {
     throw new Error(`Workflow ${workflowId} not found`);
   }
   const run = await workflowObj.createRun({ runId, resourceId, ...rest });
-  const stream = resumeData ? run.resumeStream({ resumeData, ...rest, requestContext }) : run.stream({ inputData, initialState, ...rest, requestContext });
+  const stream = resumeData ? run.resumeStream({ resumeData, ...rest, requestContext: requestContext$1 }) : run.stream({ inputData, initialState, ...rest, requestContext: requestContext$1 });
   if (version === "v6") {
     return createUIMessageStream2({
       execute: async ({ writer }) => {