@mastra/deployer 1.36.0-alpha.0 → 1.36.0-alpha.2

package/CHANGELOG.md

@@ -1,5 +1,72 @@
 # @mastra/deployer
 
+## 1.36.0-alpha.2
+
+### Patch Changes
+
+- When browser streaming is unavailable (the `ws` and `@hono/node-ws` packages aren't installed, or the deployer is running in a serverless environment), the deployer now registers a fallback `GET /api/agents/:agentId/browser/session` route that returns `{ hasSession: false, screencastAvailable: false }`. This lets clients detect that screencast won't work and skip the WebSocket upgrade instead of triggering a noisy reconnect loop. ([#16668](https://github.com/mastra-ai/mastra/pull/16668))
+
+- Bumped the `@mastra/core` peer dependency floor from `>=1.32.0-0` to `>=1.34.0-0`. ([#16666](https://github.com/mastra-ai/mastra/pull/16666))
+
+- Updated dependencies [[`5ba7253`](https://github.com/mastra-ai/mastra/commit/5ba7253745c85e8df8012a76d954c640ffa336f7), [`f73980d`](https://github.com/mastra-ai/mastra/commit/f73980d651eb5f7f1ab20582de4615a1b6f10fce), [`f73980d`](https://github.com/mastra-ai/mastra/commit/f73980d651eb5f7f1ab20582de4615a1b6f10fce), [`9c88701`](https://github.com/mastra-ai/mastra/commit/9c8870195b41a38dc40b6ba2aa55eda04df8fa69), [`f73980d`](https://github.com/mastra-ai/mastra/commit/f73980d651eb5f7f1ab20582de4615a1b6f10fce), [`9c88701`](https://github.com/mastra-ai/mastra/commit/9c8870195b41a38dc40b6ba2aa55eda04df8fa69), [`9c88701`](https://github.com/mastra-ai/mastra/commit/9c8870195b41a38dc40b6ba2aa55eda04df8fa69), [`9c88701`](https://github.com/mastra-ai/mastra/commit/9c8870195b41a38dc40b6ba2aa55eda04df8fa69), [`4e88dc6`](https://github.com/mastra-ai/mastra/commit/4e88dc6b89f154c0eae37221c8126be0c23c569f), [`19018f0`](https://github.com/mastra-ai/mastra/commit/19018f05722af74a5978781a7731a654b26f7f2a), [`5ba7253`](https://github.com/mastra-ai/mastra/commit/5ba7253745c85e8df8012a76d954c640ffa336f7)]:
+  - @mastra/core@1.36.0-alpha.2
+  - @mastra/server@1.36.0-alpha.2
+
+## 1.36.0-alpha.1
+
+### Minor Changes
+
+- Added route-specific CORS configuration so credentialed cross-origin access can be limited to selected custom routes and channel webhooks. ([#16689](https://github.com/mastra-ai/mastra/pull/16689))
+
+  ```ts
+  registerApiRoute('/customer-webhook', {
+    method: 'POST',
+    cors: {
+      origin: ['https://customer-saas.example'],
+      credentials: true,
+    },
+    handler: async c => c.json({ ok: true }),
+  });
+  ```
+
+  ```ts
+  new Agent({
+    id: 'support-agent',
+    name: 'Support Agent',
+    instructions: '...',
+    model,
+    channels: {
+      adapters: {
+        web: {
+          adapter: createWebAdapter(),
+          cors: {
+            origin: ['https://customer-saas.example'],
+            credentials: true,
+          },
+        },
+      },
+    },
+  });
+  ```
+
+  Use `server.cors` for one global CORS policy across the server:
+
+  ```ts
+  new Mastra({
+    server: {
+      cors: {
+        origin: '*',
+      },
+    },
+  });
+  ```
+
+### Patch Changes
+
+- Updated dependencies [[`8cdb86c`](https://github.com/mastra-ai/mastra/commit/8cdb86ceed1137bc2768e147dce85a0692b9fb26), [`eda90c5`](https://github.com/mastra-ai/mastra/commit/eda90c5bfd7de11805ecc9f4552716c895fbaf78), [`afc004f`](https://github.com/mastra-ai/mastra/commit/afc004f5cc7e30697809e7021820b9f5881e6719), [`408be73`](https://github.com/mastra-ai/mastra/commit/408be73449dfab92b51eab8c6623b6c443debc25)]:
+  - @mastra/core@1.36.0-alpha.1
+  - @mastra/server@1.36.0-alpha.1
+
 ## 1.36.0-alpha.0
 
 ### Patch Changes

package/dist/docs/SKILL.md

@@ -3,7 +3,7 @@ name: mastra-deployer
 description: Documentation for @mastra/deployer. Use when working with @mastra/deployer APIs, configuration, or implementation.
 metadata:
   package: "@mastra/deployer"
-  version: "1.36.0-alpha.0"
+  version: "1.36.0-alpha.2"
 ---
 
 ## When to use

package/dist/docs/assets/SOURCE_MAP.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.36.0-alpha.0",
+  "version": "1.36.0-alpha.2",
   "package": "@mastra/deployer",
   "exports": {
     "Deps": {

package/dist/server/index.cjs

@@ -17,6 +17,7 @@ var tools = require('@mastra/core/tools');
 var serverAdapter = require('@mastra/server/server-adapter');
 var util = require('util');
 var buffer = require('buffer');
+var auth = require('@mastra/server/auth');
 var browserStream = require('@mastra/server/browser-stream');
 var store = require('@mastra/server/a2a/store');
 var hono = require('hono');
@@ -3183,6 +3184,9 @@ async function setupBrowserStream(app, config2) {
   }
   const { injectWebSocket, upgradeWebSocket } = createNodeWebSocket({ app });
   const registry2 = new browserStream.ViewerRegistry();
+  const rawPrefix = config2.apiPrefix ?? "/api";
+  const trimmed = rawPrefix.endsWith("/") ? rawPrefix.slice(0, -1) : rawPrefix;
+  const apiPrefix = trimmed || "/api";
   app.get(
     "/browser/:agentId/stream",
     upgradeWebSocket((c) => {
@@ -3210,7 +3214,20 @@ async function setupBrowserStream(app, config2) {
       };
     })
   );
-  app.post("/api/agents/:agentId/browser/close", async (c) => {
+  app.get(`${apiPrefix}/agents/:agentId/browser/session`, (c) => {
+    const agentId = c.req.param("agentId");
+    if (!agentId) {
+      return c.json({ error: "Agent ID is required" }, 400);
+    }
+    const threadId = c.req.query("threadId");
+    const toolset = config2.getToolset(agentId);
+    if (!toolset) {
+      return c.json({ hasSession: false, screencastAvailable: true });
+    }
+    const hasSession = threadId ? toolset.hasThreadSession(threadId) : false;
+    return c.json({ hasSession, screencastAvailable: true });
+  });
+  app.post(`${apiPrefix}/agents/:agentId/browser/close`, async (c) => {
     const agentId = c.req.param("agentId");
     if (!agentId) {
       return c.json({ error: "Agent ID is required" }, 400);
@@ -3616,7 +3633,7 @@ var MastraServer = class extends serverAdapter.MastraServer {
         if (authConfig) {
           const hasPermission = await loadHasPermission();
           if (hasPermission) {
-            const userPermissions = c.get("requestContext").get("userPermissions");
+            const userPermissions = c.get("requestContext").get("mastra__userPermissions");
             const permissionError = this.checkRoutePermission(route, userPermissions, hasPermission);
             if (permissionError) {
               return c.json(
@@ -3713,7 +3730,7 @@ var MastraServer = class extends serverAdapter.MastraServer {
         if (authConfig) {
           const hasPermission = await loadHasPermission();
           if (hasPermission) {
-            const userPermissions = c.get("requestContext").get("userPermissions");
+            const userPermissions = c.get("requestContext").get("mastra__userPermissions");
             const permissionError = this.checkRoutePermission(serverRoute, userPermissions, hasPermission);
             if (permissionError) {
               return c.json(
@@ -4447,6 +4464,27 @@ var getStudioPath = () => {
   const studioPath = process.env.MASTRA_STUDIO_PATH || path.join(__dirname, "studio");
   return studioPath;
 };
+var DEFAULT_CORS_ALLOW_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
+var DEFAULT_CORS_ALLOW_HEADERS = ["Content-Type", "Authorization", "x-mastra-client-type", "x-mastra-dev-playground"];
+var DEFAULT_CORS_EXPOSE_HEADERS = ["Content-Length", "X-Requested-With"];
+function getCorsConfig(serverCors, credentialsDefault) {
+  const userCors = serverCors && typeof serverCors === "object" ? serverCors : void 0;
+  const origin = userCors && "origin" in userCors && userCors.origin ? userCors.origin : credentialsDefault ? (requestOrigin) => requestOrigin || void 0 : "*";
+  const credentials = userCors && "credentials" in userCors ? userCors.credentials : credentialsDefault;
+  return {
+    origin,
+    allowMethods: DEFAULT_CORS_ALLOW_METHODS,
+    credentials,
+    maxAge: 3600,
+    ...userCors,
+    allowHeaders: [...DEFAULT_CORS_ALLOW_HEADERS, ...userCors?.allowHeaders ?? []],
+    exposeHeaders: [...DEFAULT_CORS_EXPOSE_HEADERS, ...userCors?.exposeHeaders ?? []]
+  };
+}
+function getRouteCorsConfig(apiRoutes, pathname, method) {
+  const route = auth.findMatchingCustomRoute(pathname, method, apiRoutes)?.route;
+  return route?.cors;
+}
 function getToolExports(tools$1) {
   try {
     return tools$1.reduce((acc, toolModule) => {
@@ -4533,37 +4571,25 @@ async function createHonoServer(mastra, options = {
     getToolset: (agentId) => {
       const agent = mastra.getAgentById(agentId);
       return agent?.browser;
-    }
+    },
+    apiPrefix
   });
+  if (!browserStreamSetup) {
+    app.get(
+      `${apiPrefix}/agents/:agentId/browser/session`,
+      (c) => c.json({ hasSession: false, screencastAvailable: false })
+    );
+  }
   if (server?.cors === false) {
     app.use("*", timeout.timeout(server?.timeout ?? 3 * 60 * 1e3));
   } else {
     const hasAuth = !!server?.auth;
-    let corsOrigin;
-    if (server?.cors && typeof server.cors === "object" && "origin" in server.cors && server.cors.origin) {
-      corsOrigin = server.cors.origin;
-    } else if (hasAuth) {
-      corsOrigin = (origin) => origin || void 0;
-    } else {
-      corsOrigin = "*";
-    }
-    const corsConfig = {
-      origin: corsOrigin,
-      allowMethods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
-      // Enable credentials for cookie-based auth (e.g., Better Auth sessions)
-      credentials: hasAuth ? true : false,
-      maxAge: 3600,
-      ...server?.cors,
-      allowHeaders: [
-        "Content-Type",
-        "Authorization",
-        "x-mastra-client-type",
-        "x-mastra-dev-playground",
-        ...server?.cors?.allowHeaders ?? []
-      ],
-      exposeHeaders: ["Content-Length", "X-Requested-With", ...server?.cors?.exposeHeaders ?? []]
-    };
-    app.use("*", timeout.timeout(server?.timeout ?? 3 * 60 * 1e3), cors.cors(corsConfig));
+    app.use("*", timeout.timeout(server?.timeout ?? 3 * 60 * 1e3), async (c, next) => {
+      const pathname = new URL(c.req.url).pathname;
+      const method = c.req.method === "OPTIONS" ? c.req.header("Access-Control-Request-Method") ?? c.req.method : c.req.method;
+      const routeCors = getRouteCorsConfig(processedRoutes, pathname, method);
+      return cors.cors(routeCors ? getCorsConfig(routeCors, false) : getCorsConfig(server?.cors, hasAuth))(c, next);
+    });
   }
   app.get(
     "/health",