@mastra/deployer 1.58.0-alpha.1 → 1.58.0-alpha.13

package/dist/server/index.cjs

@@ -2988,6 +2988,54 @@ function toFetchResponse(res) {
 //#endregion
 //#region ../../server-adapters/hono/dist/index.js
 /**
+* Propagates a client disconnect to the simulated Node response produced by `toReqRes`.
+*
+* `fetch-to-node` builds the outgoing body from `res` events but never observes cancellation
+* of the stream it hands back. When an MCP Streamable HTTP client drops its session, nothing
+* tells `res` that the socket is gone, so the MCP transport keeps its SSE keep-alive timer
+* armed. The next keep-alive tick writes into an already-closed stream controller, and because
+* that write originates in a timer callback the resulting `ERR_INVALID_STATE` is unhandled and
+* takes down the process.
+*
+* Emitting `close` on `res` is the signal the MCP Node transport listens for: it aborts the
+* request's AbortController, which breaks the write loop and tears down the SSE stream,
+* clearing the keep-alive timer. No post-disconnect write is ever attempted.
+*/
+function propagateClientDisconnect(fetchResponse, res) {
+	const upstream = fetchResponse.body;
+	if (!upstream) return fetchResponse;
+	let disconnected = false;
+	const disconnect = () => {
+		if (disconnected) return;
+		disconnected = true;
+		try {
+			res.emit("close");
+		} catch {}
+		reader.read().then(function drain({ done }) {
+			return done ? void 0 : reader.read().then(drain);
+		}, () => {});
+	};
+	const reader = upstream.getReader();
+	const body = new ReadableStream({
+		async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			controller.enqueue(value);
+		},
+		cancel() {
+			disconnect();
+		}
+	});
+	return new Response(body, {
+		status: fetchResponse.status,
+		statusText: fetchResponse.statusText,
+		headers: fetchResponse.headers
+	});
+}
+/**
 * Set up WebSocket-based browser stream endpoint for real-time screencast viewing.
 *
 * Creates a WebSocket route at `/browser/:agentId/stream` that:
@@ -3107,6 +3155,26 @@ function loadHasPermission() {
 	});
 	return _hasPermissionPromise;
 }
+/**
+* Wrap a Hono middleware handler so it becomes a no-op for framework-public
+* routes (routes registered with `requiresAuth: false`).
+*
+* Adapters that expose user-provided middleware — for example `serverMiddleware`
+* on the Mastra instance or `server.middleware` in Mastra config — MUST wrap
+* those handlers with this before registering them. This is the framework's
+* guarantee that user middleware cannot accidentally (or intentionally) 401
+* routes the framework needs to keep reachable (e.g. Studio sign-in endpoints).
+*
+* The framework-public flag is computed once per request by
+* {@link MastraServer.registerContextMiddleware} and stashed on the Hono
+* context under `MASTRA_FRAMEWORK_PUBLIC_KEY`.
+*/
+const skipIfFrameworkPublic = (handler) => {
+	return async (c, next) => {
+		if (c.get(_mastra_server_server_adapter.MASTRA_FRAMEWORK_PUBLIC_KEY)) return next();
+		return handler(c, next);
+	};
+};
 var MastraServer = class extends _mastra_server_server_adapter.MastraServer {
 	createContextMiddleware() {
 		return async (c, next) => {
@@ -3307,7 +3375,7 @@ var MastraServer = class extends _mastra_server_server_adapter.MastraServer {
 					}
 				} catch {}
 			});
-			return await toFetchResponse(res);
+			return propagateClientDisconnect(await toFetchResponse(res), res);
 		} else if (route.responseType === "mcp-sse") {
 			const { server, ssePath, messagePath } = result;
 			try {
@@ -3487,8 +3555,8 @@ var MastraServer = class extends _mastra_server_server_adapter.MastraServer {
 		});
 	}
 	async registerCustomApiRoutes() {
-		if (!await this.buildCustomRouteHandler()) return;
-		const routes = this.customApiRoutes ?? this.mastra.getServer()?.apiRoutes ?? [];
+		const routes = await this.registerSchemaApiRoutes();
+		if (!await this.buildCustomRouteHandler(routes)) return;
 		for (const route of routes) {
 			const serverRoute = {
 				method: route.method,
@@ -3566,7 +3634,12 @@ var MastraServer = class extends _mastra_server_server_adapter.MastraServer {
 		}
 	}
 	registerContextMiddleware() {
+		const isFrameworkPublic = this.getFrameworkPublicMatcher();
 		this.app.use("*", this.createContextMiddleware());
+		this.app.use("*", async (c, next) => {
+			c.set(_mastra_server_server_adapter.MASTRA_FRAMEWORK_PUBLIC_KEY, isFrameworkPublic(c.req.path, c.req.method));
+			return next();
+		});
 		this.app.use("*", async (c, next) => {
 			await next();
 			this.warnIfUnregisteredChannelWebhook(c.req.path, c.req.method, c.res.status);
@@ -4295,6 +4368,9 @@ const getStudioPath = () => {
 	if (require("url").pathToFileURL(__filename).href) __dirname = (0, path.dirname)((0, url.fileURLToPath)(require("url").pathToFileURL(__filename).href));
 	return process.env.MASTRA_STUDIO_PATH || (0, path.join)(__dirname, "studio");
 };
+function isSchemaApiRoute(route) {
+	return "_mastraSchemaRoute" in route && route._mastraSchemaRoute === true;
+}
 const DEFAULT_CORS_ALLOW_METHODS = [
 	"GET",
 	"POST",
@@ -4306,6 +4382,7 @@ const DEFAULT_CORS_ALLOW_METHODS = [
 const DEFAULT_CORS_ALLOW_HEADERS = [
 	"Content-Type",
 	"Authorization",
+	"A2A-Version",
 	"x-mastra-client-type",
 	"x-mastra-dev-playground"
 ];
@@ -4325,7 +4402,8 @@ function getCorsConfig(serverCors, credentialsDefault) {
 	};
 }
 function getRouteCorsConfig(apiRoutes, pathname, method) {
-	return ((0, _mastra_server_auth.findMatchingCustomRoute)(pathname, method, apiRoutes)?.route)?.cors;
+	const route = (0, _mastra_server_auth.findMatchingCustomRoute)(pathname, method, apiRoutes)?.route;
+	return route && !isSchemaApiRoute(route) ? route.cors : void 0;
 }
 function getToolExports(tools) {
 	try {
@@ -4351,7 +4429,8 @@ async function createHonoServer(mastra, options = { tools: {} }) {
 	const apiPrefix = server?.apiPrefix ?? "/api";
 	const a2aTaskStore = new _mastra_server_a2a_store.InMemoryTaskStore();
 	const processedRoutes = (server?.apiRoutes)?.map((route) => {
-		if ("openapi" in route && route.openapi) {
+		if (isSchemaApiRoute(route)) return route;
+		if (route.openapi) {
 			const existingMiddleware = route.middleware ? Array.isArray(route.middleware) ? route.middleware : [route.middleware] : [];
 			return {
 				...route,
@@ -4389,7 +4468,7 @@ async function createHonoServer(mastra, options = { tools: {} }) {
 	});
 	honoServerAdapter.registerContextMiddleware();
 	const serverMiddleware = mastra.getServerMiddleware?.();
-	if (serverMiddleware && serverMiddleware.length > 0) for (const m of serverMiddleware) app.use(m.path, m.handler);
+	if (serverMiddleware && serverMiddleware.length > 0) for (const m of serverMiddleware) app.use(m.path, skipIfFrameworkPublic(m.handler));
 	const browserStreamSetup = options.browserStream === false ? null : await setupBrowserStream(app, {
 		getToolset: async (agentId) => {
 			try {
@@ -4439,7 +4518,7 @@ async function createHonoServer(mastra, options = { tools: {} }) {
 			};
 			return middleware;
 		});
-		for (const middleware of middlewares) app.use(middleware.path, middleware.handler);
+		for (const middleware of middlewares) app.use(middleware.path, skipIfFrameworkPublic(middleware.handler));
 	}
 	await honoServerAdapter.registerCustomApiRoutes();
 	if (server?.build?.apiReqLogs) app.use((0, hono_logger.logger)());