@mastra/deployer 1.36.0-alpha.0 → 1.36.0-alpha.1

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGhE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAY5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAoBnD,KAAK,QAAQ,GAAG,YAAY,CAAC;AAE7B,KAAK,SAAS,GAAG,aAAa,GAAG;IAC/B,OAAO,EAAE,GAAG,CAAC;QAAE,UAAU,EAAE,+BAA+B,CAAA;KAAE,CAAC,CAAC;CAC/D,CAAC;AAEF,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,wCAmB/D;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,mBAER;cAegC,QAAQ;eAAa,SAAS;2CAkZhE;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAmC,mDAyElG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAIlD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAIhE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAY5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAoBnD,KAAK,QAAQ,GAAG,YAAY,CAAC;AAE7B,KAAK,SAAS,GAAG,aAAa,GAAG;IAC/B,OAAO,EAAE,GAAG,CAAC;QAAE,UAAU,EAAE,+BAA+B,CAAA;KAAE,CAAC,CAAC;CAC/D,CAAC;AAgCF,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,wCAmB/D;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,mBAER;cAegC,QAAQ;eAAa,SAAS;2CA0XhE;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAmC,mDAyElG"}

package/dist/server/index.js

@@ -15,6 +15,7 @@ import { Tool } from '@mastra/core/tools';
 import { MastraServer as MastraServer$1, normalizeQueryParams, checkRouteFGA, redactStreamChunk } from '@mastra/server/server-adapter';
 import util from 'util';
 import { Buffer as Buffer$1 } from 'buffer';
+import { findMatchingCustomRoute } from '@mastra/server/auth';
 import { ViewerRegistry, handleInputMessage } from '@mastra/server/browser-stream';
 import { InMemoryTaskStore } from '@mastra/server/a2a/store';
 import { Hono } from 'hono';
@@ -4420,6 +4421,27 @@ var getStudioPath = () => {
   const studioPath = process.env.MASTRA_STUDIO_PATH || join(__dirname, "studio");
   return studioPath;
 };
+var DEFAULT_CORS_ALLOW_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
+var DEFAULT_CORS_ALLOW_HEADERS = ["Content-Type", "Authorization", "x-mastra-client-type", "x-mastra-dev-playground"];
+var DEFAULT_CORS_EXPOSE_HEADERS = ["Content-Length", "X-Requested-With"];
+function getCorsConfig(serverCors, credentialsDefault) {
+  const userCors = serverCors && typeof serverCors === "object" ? serverCors : void 0;
+  const origin = userCors && "origin" in userCors && userCors.origin ? userCors.origin : credentialsDefault ? (requestOrigin) => requestOrigin || void 0 : "*";
+  const credentials = userCors && "credentials" in userCors ? userCors.credentials : credentialsDefault;
+  return {
+    origin,
+    allowMethods: DEFAULT_CORS_ALLOW_METHODS,
+    credentials,
+    maxAge: 3600,
+    ...userCors,
+    allowHeaders: [...DEFAULT_CORS_ALLOW_HEADERS, ...userCors?.allowHeaders ?? []],
+    exposeHeaders: [...DEFAULT_CORS_EXPOSE_HEADERS, ...userCors?.exposeHeaders ?? []]
+  };
+}
+function getRouteCorsConfig(apiRoutes, pathname, method) {
+  const route = findMatchingCustomRoute(pathname, method, apiRoutes)?.route;
+  return route?.cors;
+}
 function getToolExports(tools) {
   try {
     return tools.reduce((acc, toolModule) => {
@@ -4512,31 +4534,12 @@ async function createHonoServer(mastra, options = {
     app.use("*", timeout(server?.timeout ?? 3 * 60 * 1e3));
   } else {
     const hasAuth = !!server?.auth;
-    let corsOrigin;
-    if (server?.cors && typeof server.cors === "object" && "origin" in server.cors && server.cors.origin) {
-      corsOrigin = server.cors.origin;
-    } else if (hasAuth) {
-      corsOrigin = (origin) => origin || void 0;
-    } else {
-      corsOrigin = "*";
-    }
-    const corsConfig = {
-      origin: corsOrigin,
-      allowMethods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
-      // Enable credentials for cookie-based auth (e.g., Better Auth sessions)
-      credentials: hasAuth ? true : false,
-      maxAge: 3600,
-      ...server?.cors,
-      allowHeaders: [
-        "Content-Type",
-        "Authorization",
-        "x-mastra-client-type",
-        "x-mastra-dev-playground",
-        ...server?.cors?.allowHeaders ?? []
-      ],
-      exposeHeaders: ["Content-Length", "X-Requested-With", ...server?.cors?.exposeHeaders ?? []]
-    };
-    app.use("*", timeout(server?.timeout ?? 3 * 60 * 1e3), cors(corsConfig));
+    app.use("*", timeout(server?.timeout ?? 3 * 60 * 1e3), async (c, next) => {
+      const pathname = new URL(c.req.url).pathname;
+      const method = c.req.method === "OPTIONS" ? c.req.header("Access-Control-Request-Method") ?? c.req.method : c.req.method;
+      const routeCors = getRouteCorsConfig(processedRoutes, pathname, method);
+      return cors(routeCors ? getCorsConfig(routeCors, false) : getCorsConfig(server?.cors, hasAuth))(c, next);
+    });
   }
   app.get(
     "/health",