@mastra/deployer 1.58.0-alpha.1 → 1.58.0-alpha.13

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAIlD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAIhE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAc5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAoBnD,KAAK,QAAQ,GAAG,YAAY,CAAC;AAE7B,KAAK,SAAS,GAAG,aAAa,GAAG;IAC/B,OAAO,EAAE,GAAG,CAAC;QAAE,UAAU,EAAE,+BAA+B,CAAA;KAAE,CAAC,CAAC;CAC/D,CAAC;AAkCF,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,wCAmB/D;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,mBAER;cAegC,QAAQ;eAAa,SAAS;2CA4ZhE;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAmC,mDAwHlG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAIlD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAIhE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAc5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAoBnD,KAAK,QAAQ,GAAG,YAAY,CAAC;AAE7B,KAAK,SAAS,GAAG,aAAa,GAAG;IAC/B,OAAO,EAAE,GAAG,CAAC;QAAE,UAAU,EAAE,+BAA+B,CAAA;KAAE,CAAC,CAAC;CAC/D,CAAC;AA8CF,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,wCAmB/D;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,mBAER;cAegC,QAAQ;eAAa,SAAS;2CAsahE;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAmC,mDAwHlG"}

package/dist/server/index.js

@@ -13,7 +13,7 @@ import process$1, { versions } from "process";
 import { getMimeType } from "hono/utils/mime";
 import { html } from "hono/html";
 import { Tool } from "@mastra/core/tools";
-import { MastraServer, checkRouteFGA, isZodError, normalizeQueryParams, redactStreamChunk, serializeStreamChunk } from "@mastra/server/server-adapter";
+import { MASTRA_FRAMEWORK_PUBLIC_KEY, MastraServer, checkRouteFGA, isZodError, normalizeQueryParams, redactStreamChunk, serializeStreamChunk } from "@mastra/server/server-adapter";
 import util from "util";
 import { Buffer as Buffer$1 } from "buffer";
 import { bodyLimit } from "hono/body-limit";
@@ -2983,6 +2983,54 @@ function toFetchResponse(res) {
 //#endregion
 //#region ../../server-adapters/hono/dist/index.js
 /**
+* Propagates a client disconnect to the simulated Node response produced by `toReqRes`.
+*
+* `fetch-to-node` builds the outgoing body from `res` events but never observes cancellation
+* of the stream it hands back. When an MCP Streamable HTTP client drops its session, nothing
+* tells `res` that the socket is gone, so the MCP transport keeps its SSE keep-alive timer
+* armed. The next keep-alive tick writes into an already-closed stream controller, and because
+* that write originates in a timer callback the resulting `ERR_INVALID_STATE` is unhandled and
+* takes down the process.
+*
+* Emitting `close` on `res` is the signal the MCP Node transport listens for: it aborts the
+* request's AbortController, which breaks the write loop and tears down the SSE stream,
+* clearing the keep-alive timer. No post-disconnect write is ever attempted.
+*/
+function propagateClientDisconnect(fetchResponse, res) {
+	const upstream = fetchResponse.body;
+	if (!upstream) return fetchResponse;
+	let disconnected = false;
+	const disconnect = () => {
+		if (disconnected) return;
+		disconnected = true;
+		try {
+			res.emit("close");
+		} catch {}
+		reader.read().then(function drain({ done }) {
+			return done ? void 0 : reader.read().then(drain);
+		}, () => {});
+	};
+	const reader = upstream.getReader();
+	const body = new ReadableStream({
+		async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			controller.enqueue(value);
+		},
+		cancel() {
+			disconnect();
+		}
+	});
+	return new Response(body, {
+		status: fetchResponse.status,
+		statusText: fetchResponse.statusText,
+		headers: fetchResponse.headers
+	});
+}
+/**
 * Set up WebSocket-based browser stream endpoint for real-time screencast viewing.
 *
 * Creates a WebSocket route at `/browser/:agentId/stream` that:
@@ -3102,6 +3150,26 @@ function loadHasPermission() {
 	});
 	return _hasPermissionPromise;
 }
+/**
+* Wrap a Hono middleware handler so it becomes a no-op for framework-public
+* routes (routes registered with `requiresAuth: false`).
+*
+* Adapters that expose user-provided middleware — for example `serverMiddleware`
+* on the Mastra instance or `server.middleware` in Mastra config — MUST wrap
+* those handlers with this before registering them. This is the framework's
+* guarantee that user middleware cannot accidentally (or intentionally) 401
+* routes the framework needs to keep reachable (e.g. Studio sign-in endpoints).
+*
+* The framework-public flag is computed once per request by
+* {@link MastraServer.registerContextMiddleware} and stashed on the Hono
+* context under `MASTRA_FRAMEWORK_PUBLIC_KEY`.
+*/
+const skipIfFrameworkPublic = (handler) => {
+	return async (c, next) => {
+		if (c.get(MASTRA_FRAMEWORK_PUBLIC_KEY)) return next();
+		return handler(c, next);
+	};
+};
 var MastraServer$1 = class extends MastraServer {
 	createContextMiddleware() {
 		return async (c, next) => {
@@ -3302,7 +3370,7 @@ var MastraServer$1 = class extends MastraServer {
 					}
 				} catch {}
 			});
-			return await toFetchResponse(res);
+			return propagateClientDisconnect(await toFetchResponse(res), res);
 		} else if (route.responseType === "mcp-sse") {
 			const { server, ssePath, messagePath } = result;
 			try {
@@ -3482,8 +3550,8 @@ var MastraServer$1 = class extends MastraServer {
 		});
 	}
 	async registerCustomApiRoutes() {
-		if (!await this.buildCustomRouteHandler()) return;
-		const routes = this.customApiRoutes ?? this.mastra.getServer()?.apiRoutes ?? [];
+		const routes = await this.registerSchemaApiRoutes();
+		if (!await this.buildCustomRouteHandler(routes)) return;
 		for (const route of routes) {
 			const serverRoute = {
 				method: route.method,
@@ -3561,7 +3629,12 @@ var MastraServer$1 = class extends MastraServer {
 		}
 	}
 	registerContextMiddleware() {
+		const isFrameworkPublic = this.getFrameworkPublicMatcher();
 		this.app.use("*", this.createContextMiddleware());
+		this.app.use("*", async (c, next) => {
+			c.set(MASTRA_FRAMEWORK_PUBLIC_KEY, isFrameworkPublic(c.req.path, c.req.method));
+			return next();
+		});
 		this.app.use("*", async (c, next) => {
 			await next();
 			this.warnIfUnregisteredChannelWebhook(c.req.path, c.req.method, c.res.status);
@@ -4290,6 +4363,9 @@ const getStudioPath = () => {
 	if (import.meta.url) __dirname = dirname(fileURLToPath(import.meta.url));
 	return process.env.MASTRA_STUDIO_PATH || join(__dirname, "studio");
 };
+function isSchemaApiRoute(route) {
+	return "_mastraSchemaRoute" in route && route._mastraSchemaRoute === true;
+}
 const DEFAULT_CORS_ALLOW_METHODS = [
 	"GET",
 	"POST",
@@ -4301,6 +4377,7 @@ const DEFAULT_CORS_ALLOW_METHODS = [
 const DEFAULT_CORS_ALLOW_HEADERS = [
 	"Content-Type",
 	"Authorization",
+	"A2A-Version",
 	"x-mastra-client-type",
 	"x-mastra-dev-playground"
 ];
@@ -4320,7 +4397,8 @@ function getCorsConfig(serverCors, credentialsDefault) {
 	};
 }
 function getRouteCorsConfig(apiRoutes, pathname, method) {
-	return (findMatchingCustomRoute(pathname, method, apiRoutes)?.route)?.cors;
+	const route = findMatchingCustomRoute(pathname, method, apiRoutes)?.route;
+	return route && !isSchemaApiRoute(route) ? route.cors : void 0;
 }
 function getToolExports(tools) {
 	try {
@@ -4346,7 +4424,8 @@ async function createHonoServer(mastra, options = { tools: {} }) {
 	const apiPrefix = server?.apiPrefix ?? "/api";
 	const a2aTaskStore = new InMemoryTaskStore();
 	const processedRoutes = (server?.apiRoutes)?.map((route) => {
-		if ("openapi" in route && route.openapi) {
+		if (isSchemaApiRoute(route)) return route;
+		if (route.openapi) {
 			const existingMiddleware = route.middleware ? Array.isArray(route.middleware) ? route.middleware : [route.middleware] : [];
 			return {
 				...route,
@@ -4384,7 +4463,7 @@ async function createHonoServer(mastra, options = { tools: {} }) {
 	});
 	honoServerAdapter.registerContextMiddleware();
 	const serverMiddleware = mastra.getServerMiddleware?.();
-	if (serverMiddleware && serverMiddleware.length > 0) for (const m of serverMiddleware) app.use(m.path, m.handler);
+	if (serverMiddleware && serverMiddleware.length > 0) for (const m of serverMiddleware) app.use(m.path, skipIfFrameworkPublic(m.handler));
 	const browserStreamSetup = options.browserStream === false ? null : await setupBrowserStream(app, {
 		getToolset: async (agentId) => {
 			try {
@@ -4434,7 +4513,7 @@ async function createHonoServer(mastra, options = { tools: {} }) {
 			};
 			return middleware;
 		});
-		for (const middleware of middlewares) app.use(middleware.path, middleware.handler);
+		for (const middleware of middlewares) app.use(middleware.path, skipIfFrameworkPublic(middleware.handler));
 	}
 	await honoServerAdapter.registerCustomApiRoutes();
 	if (server?.build?.apiReqLogs) app.use(logger());