@mastra/deployer 1.36.0-alpha.0 → 1.36.0-alpha.10

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGhE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAY5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAoBnD,KAAK,QAAQ,GAAG,YAAY,CAAC;AAE7B,KAAK,SAAS,GAAG,aAAa,GAAG;IAC/B,OAAO,EAAE,GAAG,CAAC;QAAE,UAAU,EAAE,+BAA+B,CAAA;KAAE,CAAC,CAAC;CAC/D,CAAC;AAEF,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,wCAmB/D;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,mBAER;cAegC,QAAQ;eAAa,SAAS;2CAkZhE;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAmC,mDAyElG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAIlD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAIhE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAY5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAoBnD,KAAK,QAAQ,GAAG,YAAY,CAAC;AAE7B,KAAK,SAAS,GAAG,aAAa,GAAG;IAC/B,OAAO,EAAE,GAAG,CAAC;QAAE,UAAU,EAAE,+BAA+B,CAAA;KAAE,CAAC,CAAC;CAC/D,CAAC;AAgCF,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,wCAmB/D;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,mBAER;cAegC,QAAQ;eAAa,SAAS;2CAmZhE;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAmC,mDAyElG"}

package/dist/server/index.js

@@ -15,6 +15,7 @@ import { Tool } from '@mastra/core/tools';
 import { MastraServer as MastraServer$1, normalizeQueryParams, checkRouteFGA, redactStreamChunk } from '@mastra/server/server-adapter';
 import util from 'util';
 import { Buffer as Buffer$1 } from 'buffer';
+import { findMatchingCustomRoute } from '@mastra/server/auth';
 import { ViewerRegistry, handleInputMessage } from '@mastra/server/browser-stream';
 import { InMemoryTaskStore } from '@mastra/server/a2a/store';
 import { Hono } from 'hono';
@@ -3156,6 +3157,9 @@ async function setupBrowserStream(app, config2) {
   }
   const { injectWebSocket, upgradeWebSocket } = createNodeWebSocket({ app });
   const registry2 = new ViewerRegistry();
+  const rawPrefix = config2.apiPrefix ?? "/api";
+  const trimmed = rawPrefix.endsWith("/") ? rawPrefix.slice(0, -1) : rawPrefix;
+  const apiPrefix = trimmed || "/api";
   app.get(
     "/browser/:agentId/stream",
     upgradeWebSocket((c) => {
@@ -3170,7 +3174,7 @@ async function setupBrowserStream(app, config2) {
         onMessage(event, _ws) {
           const data = typeof event.data === "string" ? event.data : null;
           if (data) {
-            handleInputMessage(data, config2.getToolset, agentId, threadId);
+            void handleInputMessage(data, config2.getToolset, agentId, threadId);
           }
         },
         onClose(_event, ws) {
@@ -3183,12 +3187,25 @@ async function setupBrowserStream(app, config2) {
       };
     })
   );
-  app.post("/api/agents/:agentId/browser/close", async (c) => {
+  app.get(`${apiPrefix}/agents/:agentId/browser/session`, async (c) => {
     const agentId = c.req.param("agentId");
     if (!agentId) {
       return c.json({ error: "Agent ID is required" }, 400);
     }
-    const toolset = config2.getToolset(agentId);
+    const threadId = c.req.query("threadId");
+    const toolset = await config2.getToolset(agentId);
+    if (!toolset) {
+      return c.json({ hasSession: false, screencastAvailable: true });
+    }
+    const hasSession = threadId ? toolset.hasThreadSession(threadId) : false;
+    return c.json({ hasSession, screencastAvailable: true });
+  });
+  app.post(`${apiPrefix}/agents/:agentId/browser/close`, async (c) => {
+    const agentId = c.req.param("agentId");
+    if (!agentId) {
+      return c.json({ error: "Agent ID is required" }, 400);
+    }
+    const toolset = await config2.getToolset(agentId);
     if (!toolset) {
       return c.json({ error: "No browser session for this agent" }, 404);
     }
@@ -3589,7 +3606,7 @@ var MastraServer = class extends MastraServer$1 {
         if (authConfig) {
           const hasPermission = await loadHasPermission();
           if (hasPermission) {
-            const userPermissions = c.get("requestContext").get("userPermissions");
+            const userPermissions = c.get("requestContext").get("mastra__userPermissions");
             const permissionError = this.checkRoutePermission(route, userPermissions, hasPermission);
             if (permissionError) {
               return c.json(
@@ -3686,7 +3703,7 @@ var MastraServer = class extends MastraServer$1 {
         if (authConfig) {
           const hasPermission = await loadHasPermission();
           if (hasPermission) {
-            const userPermissions = c.get("requestContext").get("userPermissions");
+            const userPermissions = c.get("requestContext").get("mastra__userPermissions");
             const permissionError = this.checkRoutePermission(serverRoute, userPermissions, hasPermission);
             if (permissionError) {
               return c.json(
@@ -4420,6 +4437,27 @@ var getStudioPath = () => {
   const studioPath = process.env.MASTRA_STUDIO_PATH || join(__dirname, "studio");
   return studioPath;
 };
+var DEFAULT_CORS_ALLOW_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
+var DEFAULT_CORS_ALLOW_HEADERS = ["Content-Type", "Authorization", "x-mastra-client-type", "x-mastra-dev-playground"];
+var DEFAULT_CORS_EXPOSE_HEADERS = ["Content-Length", "X-Requested-With"];
+function getCorsConfig(serverCors, credentialsDefault) {
+  const userCors = serverCors && typeof serverCors === "object" ? serverCors : void 0;
+  const origin = userCors && "origin" in userCors && userCors.origin ? userCors.origin : credentialsDefault ? (requestOrigin) => requestOrigin || void 0 : "*";
+  const credentials = userCors && "credentials" in userCors ? userCors.credentials : credentialsDefault;
+  return {
+    origin,
+    allowMethods: DEFAULT_CORS_ALLOW_METHODS,
+    credentials,
+    maxAge: 3600,
+    ...userCors,
+    allowHeaders: [...DEFAULT_CORS_ALLOW_HEADERS, ...userCors?.allowHeaders ?? []],
+    exposeHeaders: [...DEFAULT_CORS_EXPOSE_HEADERS, ...userCors?.exposeHeaders ?? []]
+  };
+}
+function getRouteCorsConfig(apiRoutes, pathname, method) {
+  const route = findMatchingCustomRoute(pathname, method, apiRoutes)?.route;
+  return route?.cors;
+}
 function getToolExports(tools) {
   try {
     return tools.reduce((acc, toolModule) => {
@@ -4503,40 +4541,39 @@ async function createHonoServer(mastra, options = {
     }
   }
   const browserStreamSetup = await setupBrowserStream(app, {
-    getToolset: (agentId) => {
-      const agent = mastra.getAgentById(agentId);
-      return agent?.browser;
-    }
+    getToolset: async (agentId) => {
+      try {
+        const runtimeAgent = mastra.getAgentById(agentId);
+        if (runtimeAgent) {
+          return runtimeAgent.browser;
+        }
+      } catch {
+      }
+      try {
+        const storedAgent = await mastra.getEditor?.()?.agent.getById(agentId);
+        return storedAgent?.browser;
+      } catch {
+        return void 0;
+      }
+    },
+    apiPrefix
   });
+  if (!browserStreamSetup) {
+    app.get(
+      `${apiPrefix}/agents/:agentId/browser/session`,
+      (c) => c.json({ hasSession: false, screencastAvailable: false })
+    );
+  }
   if (server?.cors === false) {
     app.use("*", timeout(server?.timeout ?? 3 * 60 * 1e3));
   } else {
     const hasAuth = !!server?.auth;
-    let corsOrigin;
-    if (server?.cors && typeof server.cors === "object" && "origin" in server.cors && server.cors.origin) {
-      corsOrigin = server.cors.origin;
-    } else if (hasAuth) {
-      corsOrigin = (origin) => origin || void 0;
-    } else {
-      corsOrigin = "*";
-    }
-    const corsConfig = {
-      origin: corsOrigin,
-      allowMethods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
-      // Enable credentials for cookie-based auth (e.g., Better Auth sessions)
-      credentials: hasAuth ? true : false,
-      maxAge: 3600,
-      ...server?.cors,
-      allowHeaders: [
-        "Content-Type",
-        "Authorization",
-        "x-mastra-client-type",
-        "x-mastra-dev-playground",
-        ...server?.cors?.allowHeaders ?? []
-      ],
-      exposeHeaders: ["Content-Length", "X-Requested-With", ...server?.cors?.exposeHeaders ?? []]
-    };
-    app.use("*", timeout(server?.timeout ?? 3 * 60 * 1e3), cors(corsConfig));
+    app.use("*", timeout(server?.timeout ?? 3 * 60 * 1e3), async (c, next) => {
+      const pathname = new URL(c.req.url).pathname;
+      const method = c.req.method === "OPTIONS" ? c.req.header("Access-Control-Request-Method") ?? c.req.method : c.req.method;
+      const routeCors = getRouteCorsConfig(processedRoutes, pathname, method);
+      return cors(routeCors ? getCorsConfig(routeCors, false) : getCorsConfig(server?.cors, hasAuth))(c, next);
+    });
   }
   app.get(
     "/health",