@mastra/client-js 1.24.0 → 1.25.1-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # @mastra/client-js
 
+## 1.25.1-alpha.0
+
+### Patch Changes
+
+- Security remediation for the 2026-06-17 "easy-day-js" supply-chain incident. Patch bump to publish clean versions and move the `latest` dist-tag forward, superseding the compromised versions that declared the malicious `easy-day-js` dependency. ([#18056](https://github.com/mastra-ai/mastra/pull/18056))
+
+- Updated dependencies [[`77a2351`](https://github.com/mastra-ai/mastra/commit/77a2351ee79296e360bce822cb3391f7cfd6489d)]:
+  - @mastra/core@1.43.1-alpha.0
+  - @mastra/schema-compat@1.2.14-alpha.0
+
+## 1.25.0
+
+### Minor Changes
+
+- Added server and client APIs for source-backed stored agent workflows. ([#17583](https://github.com/mastra-ai/mastra/pull/17583))
+
+  The stored agent API can now report editor source capabilities, export owned agent override JSON, and open provider-backed change requests from the server. The client SDK exposes matching methods so Studio and other clients can use the same stored-agent workflow without calling a source provider directly.
+
+  ```ts
+  const storedAgent = client.getStoredAgent('weather-agent');
+  const exported = await storedAgent.export({ instructions: '...' });
+  await storedAgent.openChangeRequest({
+    instructions: '...',
+    changeMessage: 'Tune weather instructions',
+  });
+  ```
+
+### Patch Changes
+
+- Fixed client tool model output so multimodal content uses the AI SDK media format. ([#17825](https://github.com/mastra-ai/mastra/pull/17825))
+
+- Republished clean patch versions after compromised npm releases were published outside of the trusted release workflow. ([#18049](https://github.com/mastra-ai/mastra/pull/18049))
+
+  These packages must be released as clean versions higher than the compromised versions currently present on npm so semver ranges resolve to trusted tarballs.
+
+- Fixed client tools ignoring `toModelOutput`. Client tools defined with a `toModelOutput` function now send their transformed output to the model, the same way server tools do. Previously the mapping was silently skipped for client tools, so multimodal tool results (for example screenshots returned as images) reached the model as stringified JSON instead of native image content. The raw tool result is still preserved for storage and application logic; only what the model sees changes. Fixes https://github.com/mastra-ai/mastra/issues/17792 ([#17825](https://github.com/mastra-ai/mastra/pull/17825))
+
+- Updated dependencies [[`de66bb0`](https://github.com/mastra-ai/mastra/commit/de66bb040570444c702ce4d8e1e228a5de2949cb), [`67bf8e2`](https://github.com/mastra-ai/mastra/commit/67bf8e206dfe583954d96015cf0d09f7ac50e45f), [`8216d05`](https://github.com/mastra-ai/mastra/commit/8216d0528d866eb9a07f5d4c87ea3bb1e1139b45), [`d18b23c`](https://github.com/mastra-ai/mastra/commit/d18b23c5e29dfc381e73e3c51fcf6c779afd1823), [`5eb94eb`](https://github.com/mastra-ai/mastra/commit/5eb94ebcf66d4e28c9e26d5821ac93379bab20a0), [`1fa3e12`](https://github.com/mastra-ai/mastra/commit/1fa3e123582b63cfe49de4ee52dc6a065e8d956a), [`f9ee2ac`](https://github.com/mastra-ai/mastra/commit/f9ee2ac661af584e61bc063ac208c9035cd752ef), [`c853d53`](https://github.com/mastra-ai/mastra/commit/c853d535d2df84ab89db1adb4c28900c54c9a2d2), [`d8df1f8`](https://github.com/mastra-ai/mastra/commit/d8df1f8e947e1966c9d4e54713df56d0d0d65226), [`9192ddb`](https://github.com/mastra-ai/mastra/commit/9192ddbced8949113b30de444cbe763f075b59f5), [`ae96523`](https://github.com/mastra-ai/mastra/commit/ae965231f562d9766b0c90c49a69fc68acaa031c), [`17d5a92`](https://github.com/mastra-ai/mastra/commit/17d5a9211aa293b4d4418de3de70dc0394d58101), [`5573693`](https://github.com/mastra-ai/mastra/commit/5573693b589822250e20dfe6cf66e9ff3bc96da8), [`ec4da8a`](https://github.com/mastra-ai/mastra/commit/ec4da8a09e0d2ab452c6ee2c786042ea826b77e5), [`adc44e1`](https://github.com/mastra-ai/mastra/commit/adc44e13c7e570b91e86b20ea7556e61d819db31), [`ed346c0`](https://github.com/mastra-ai/mastra/commit/ed346c0bee2d8496690a4e538bfba1e46894660f), [`9b1adf7`](https://github.com/mastra-ai/mastra/commit/9b1adf7f39943c869182106bc4016e793b3304ac), [`c9ce1b2`](https://github.com/mastra-ai/mastra/commit/c9ce1b28d10871110648f9d7b6d76e880b9fa999), [`3ef01fd`](https://github.com/mastra-ai/mastra/commit/3ef01fd130b53d5bd4f828beb174e516a2eb1158), [`245a9a3`](https://github.com/mastra-ai/mastra/commit/245a9a315705fce17ddd980f78a92504b6615c4a), [`dc0b611`](https://github.com/mastra-ai/mastra/commit/dc0b6119b769bd00ee2c5df9259fb376fe63077a), [`38b5de8`](https://github.com/mastra-ai/mastra/commit/38b5de8e5d1d41a69522addf53d96f4b3a1d5bf0), [`dc0b611`](https://github.com/mastra-ai/mastra/commit/dc0b6119b769bd00ee2c5df9259fb376fe63077a), [`dd6a66e`](https://github.com/mastra-ai/mastra/commit/dd6a66ea0b32e0dea8059aec6b35d151e2c87dc4), [`d785c59`](https://github.com/mastra-ai/mastra/commit/d785c593b67fcb4cdc4fab9fdbde5f3b7665efc0), [`1fa3e12`](https://github.com/mastra-ai/mastra/commit/1fa3e123582b63cfe49de4ee52dc6a065e8d956a), [`8b984f4`](https://github.com/mastra-ai/mastra/commit/8b984f4361c202270ceb69257185c4756c9a7c56), [`bf08402`](https://github.com/mastra-ai/mastra/commit/bf084022374fa5d06ca70ed67a86dd64e379071b), [`81fe587`](https://github.com/mastra-ai/mastra/commit/81fe587275035715c1720ddf3fee0505cf053036), [`1fa3e12`](https://github.com/mastra-ai/mastra/commit/1fa3e123582b63cfe49de4ee52dc6a065e8d956a), [`403c438`](https://github.com/mastra-ai/mastra/commit/403c438e417278989ce247233d2c465b8d902cdd), [`f8ba195`](https://github.com/mastra-ai/mastra/commit/f8ba1954e27ee2b20586cc6cd9cf13c002c232f2)]:
+  - @mastra/core@1.43.0
+  - @mastra/schema-compat@1.2.12
+
 ## 1.24.0
 
 ### Minor Changes

package/dist/docs/SKILL.md

@@ -3,7 +3,7 @@ name: mastra-client-js
 description: Documentation for @mastra/client-js. Use when working with @mastra/client-js APIs, configuration, or implementation.
 metadata:
   package: "@mastra/client-js"
-  version: "1.24.0"
+  version: "1.25.1-alpha.0"
 ---
 
 ## When to use

package/dist/docs/assets/SOURCE_MAP.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.24.0",
+  "version": "1.25.1-alpha.0",
   "package": "@mastra/client-js",
   "exports": {
     "RequestContext": {

package/dist/docs/references/reference-client-js-agents.md

@@ -522,6 +522,26 @@ response.processDataStream({
 })
 ```
 
+### Shape client tool output for the model
+
+Client tools support `toModelOutput` to control what the model receives, including multimodal content such as images. Because client tools execute locally, the mapping also runs on the client after `execute` completes. The transformed output is sent back to the server alongside the raw result, so the raw result stays available for storage and application logic.
+
+```typescript
+const screenshotTool = createTool({
+  id: 'takeScreenshot',
+  description: 'Takes a screenshot of the current page',
+  inputSchema: z.object({}),
+  execute: async () => {
+    const base64 = await captureScreenshot()
+    return { ok: true, data: base64 }
+  },
+  toModelOutput: output => ({
+    type: 'content',
+    value: [{ type: 'media', data: output.data, mediaType: 'image/jpeg' }],
+  }),
+})
+```
+
 ### Tracing client tools
 
 When `@mastra/observability` is installed and configured on the server, a client-side tool records a `CLIENT_TOOL_CALL` span as a child of the current `AGENT_RUN` span. The server creates that span when the model emits the client tool call, injects a W3C trace carrier into the outgoing tool-call chunk, and ends the span once the tool arguments are available. Without server-side observability configured, client tool tracing is a no-op.

package/dist/index.cjs

@@ -302,6 +302,40 @@ function requestContextQueryString(requestContext, delimiter = "?") {
   const queryString = searchParams.toString();
   return queryString ? `${delimiter}${queryString}` : "";
 }
+
+// src/utils/client-tool-model-output.ts
+function normalizeModelOutput(output) {
+  if (output == null || typeof output !== "object") return output;
+  const obj = output;
+  if (obj.type !== "content" || !Array.isArray(obj.value)) return output;
+  return {
+    ...obj,
+    value: obj.value.map((item) => {
+      if (item == null || typeof item !== "object") return item;
+      const part = item;
+      if (part.type === "image-url" && typeof part.url === "string") {
+        const semicolonIndex = part.url.indexOf(";");
+        const commaIndex = part.url.indexOf(",");
+        const mediaTypeEnd = semicolonIndex === -1 ? commaIndex : commaIndex === -1 ? semicolonIndex : Math.min(semicolonIndex, commaIndex);
+        const mediaType = typeof part.mediaType === "string" && part.mediaType ? part.mediaType : part.url.startsWith("data:") ? part.url.slice(5, mediaTypeEnd === -1 ? void 0 : mediaTypeEnd) || "image/jpeg" : "image/jpeg";
+        return { type: "media", data: part.url, mediaType };
+      }
+      if (part.type === "image-data" && typeof part.data === "string") {
+        return { type: "media", data: part.data, mediaType: part.mediaType ?? "image/jpeg" };
+      }
+      if (part.type === "file-data" && typeof part.data === "string") {
+        return { type: "media", data: part.data, mediaType: part.mediaType ?? "application/octet-stream" };
+      }
+      return part;
+    })
+  };
+}
+async function getClientToolModelOutput(clientTool, result) {
+  const toModelOutput = clientTool.toModelOutput;
+  if (typeof toModelOutput !== "function" || result == null) return void 0;
+  const modelOutput = await toModelOutput(result);
+  return modelOutput == null ? void 0 : normalizeModelOutput(modelOutput);
+}
 function isZodType(value) {
   return typeof value === "object" && value !== null && "_def" in value && "parse" in value && typeof value.parse === "function" && "safeParse" in value && typeof value.safeParse === "function";
 }
@@ -596,11 +630,15 @@ async function executeToolCallAndRespond({
             }
           }
         });
+        const modelOutput = await getClientToolModelOutput(clientTool, result);
         const toolResultContent = {
           type: "tool-result",
           toolCallId: toolCall.payload.toolCallId,
           toolName: toolCall.payload.toolName,
-          result
+          result,
+          // Carry the client-side toModelOutput result so the server uses it
+          // when building the model prompt, while result keeps the raw value.
+          ...modelOutput != null ? { providerOptions: { mastra: { modelOutput } } } : {}
         };
         if (observability) {
           toolResultContent.__mastraObservability = observability;
@@ -948,6 +986,7 @@ var Agent = class extends BaseResource {
             const clientTool = activeClientTools[toolCall.toolName];
             if (!clientTool || typeof clientTool.execute !== "function") continue;
             let result;
+            let modelOutput;
             let observability;
             try {
               const execution = await executeClientToolWithObservability({
@@ -971,8 +1010,14 @@ var Agent = class extends BaseResource {
               });
               result = execution.result;
               observability = execution.observability;
+              try {
+                modelOutput = await getClientToolModelOutput(clientTool, result);
+              } catch {
+                modelOutput = void 0;
+              }
             } catch (error) {
               result = { error: String(error) };
+              modelOutput = void 0;
             }
             const toolResultContent = {
               type: "tool-result",
@@ -998,6 +1043,9 @@ var Agent = class extends BaseResource {
               toolCallId: toolCall.toolCallId,
               toolName: toolCall.toolName,
               output: { type: "json", value: result },
+              // Carry the client-side toModelOutput result so the server uses it
+              // when building the model prompt, while output keeps the raw result.
+              ...modelOutput != null ? { providerOptions: { mastra: { modelOutput } } } : {},
               ...observability ? { __mastraObservability: observability } : {}
             };
             toolResultMessages.push({
@@ -1979,6 +2027,7 @@ var Agent = class extends BaseResource {
                 shouldExecuteClientTool = true;
                 const runId = streamRunId ?? toolCall2.toolCallId;
                 let result;
+                let modelOutput;
                 let observability;
                 let synthetic;
                 try {
@@ -2001,6 +2050,7 @@ var Agent = class extends BaseResource {
                       }
                     }
                   }));
+                  modelOutput = await getClientToolModelOutput(clientTool, result);
                   synthetic = {
                     type: "tool-result",
                     runId,
@@ -2059,6 +2109,14 @@ var Agent = class extends BaseResource {
                     result,
                     ...observability ? { __mastraObservability: observability } : {}
                   };
+                  if (modelOutput != null) {
+                    const partWithMetadata = toolInvocationPart;
+                    const existingMastra = partWithMetadata.providerMetadata?.mastra != null && typeof partWithMetadata.providerMetadata.mastra === "object" ? partWithMetadata.providerMetadata.mastra : {};
+                    partWithMetadata.providerMetadata = {
+                      ...partWithMetadata.providerMetadata,
+                      mastra: { ...existingMastra, modelOutput }
+                    };
+                  }
                 }
                 const toolInvocation = lastMessage?.toolInvocations?.find(
                   (toolInvocation2) => toolInvocation2.toolCallId === toolCall2.toolCallId
@@ -4814,6 +4872,15 @@ var StoredAgent = class extends BaseResource {
       body: params
     });
   }
+  /**
+   * Opens a source-provider change request for deterministic agent JSON without mutating storage.
+   */
+  openChangeRequest(params) {
+    return this.request(`/stored/agents/${encodeURIComponent(this.storedAgentId)}/change-request`, {
+      method: "POST",
+      body: params
+    });
+  }
   /**
    * Deletes the stored agent
    * @param requestContext - Optional request context to pass as query parameter