@mastra/deployer 1.58.0-alpha.1 → 1.58.0-alpha.4

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAIlD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAIhE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAc5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAoBnD,KAAK,QAAQ,GAAG,YAAY,CAAC;AAE7B,KAAK,SAAS,GAAG,aAAa,GAAG;IAC/B,OAAO,EAAE,GAAG,CAAC;QAAE,UAAU,EAAE,+BAA+B,CAAA;KAAE,CAAC,CAAC;CAC/D,CAAC;AAkCF,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,wCAmB/D;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,mBAER;cAegC,QAAQ;eAAa,SAAS;2CA4ZhE;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAmC,mDAwHlG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAIlD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAIhE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAc5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAoBnD,KAAK,QAAQ,GAAG,YAAY,CAAC;AAE7B,KAAK,SAAS,GAAG,aAAa,GAAG;IAC/B,OAAO,EAAE,GAAG,CAAC;QAAE,UAAU,EAAE,+BAA+B,CAAA;KAAE,CAAC,CAAC;CAC/D,CAAC;AAwCF,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,wCAmB/D;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,mBAER;cAegC,QAAQ;eAAa,SAAS;2CAkahE;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAmC,mDAwHlG"}

package/dist/server/index.js

@@ -13,7 +13,7 @@ import process$1, { versions } from "process";
 import { getMimeType } from "hono/utils/mime";
 import { html } from "hono/html";
 import { Tool } from "@mastra/core/tools";
-import { MastraServer, checkRouteFGA, isZodError, normalizeQueryParams, redactStreamChunk, serializeStreamChunk } from "@mastra/server/server-adapter";
+import { MASTRA_FRAMEWORK_PUBLIC_KEY, MastraServer, checkRouteFGA, isZodError, normalizeQueryParams, redactStreamChunk, serializeStreamChunk } from "@mastra/server/server-adapter";
 import util from "util";
 import { Buffer as Buffer$1 } from "buffer";
 import { bodyLimit } from "hono/body-limit";
@@ -3102,6 +3102,26 @@ function loadHasPermission() {
 	});
 	return _hasPermissionPromise;
 }
+/**
+* Wrap a Hono middleware handler so it becomes a no-op for framework-public
+* routes (routes registered with `requiresAuth: false`).
+*
+* Adapters that expose user-provided middleware — for example `serverMiddleware`
+* on the Mastra instance or `server.middleware` in Mastra config — MUST wrap
+* those handlers with this before registering them. This is the framework's
+* guarantee that user middleware cannot accidentally (or intentionally) 401
+* routes the framework needs to keep reachable (e.g. Studio sign-in endpoints).
+*
+* The framework-public flag is computed once per request by
+* {@link MastraServer.registerContextMiddleware} and stashed on the Hono
+* context under `MASTRA_FRAMEWORK_PUBLIC_KEY`.
+*/
+const skipIfFrameworkPublic = (handler) => {
+	return async (c, next) => {
+		if (c.get(MASTRA_FRAMEWORK_PUBLIC_KEY)) return next();
+		return handler(c, next);
+	};
+};
 var MastraServer$1 = class extends MastraServer {
 	createContextMiddleware() {
 		return async (c, next) => {
@@ -3561,7 +3581,12 @@ var MastraServer$1 = class extends MastraServer {
 		}
 	}
 	registerContextMiddleware() {
+		const isFrameworkPublic = this.getFrameworkPublicMatcher();
 		this.app.use("*", this.createContextMiddleware());
+		this.app.use("*", async (c, next) => {
+			c.set(MASTRA_FRAMEWORK_PUBLIC_KEY, isFrameworkPublic(c.req.path, c.req.method));
+			return next();
+		});
 		this.app.use("*", async (c, next) => {
 			await next();
 			this.warnIfUnregisteredChannelWebhook(c.req.path, c.req.method, c.res.status);
@@ -4301,6 +4326,7 @@ const DEFAULT_CORS_ALLOW_METHODS = [
 const DEFAULT_CORS_ALLOW_HEADERS = [
 	"Content-Type",
 	"Authorization",
+	"A2A-Version",
 	"x-mastra-client-type",
 	"x-mastra-dev-playground"
 ];
@@ -4384,7 +4410,7 @@ async function createHonoServer(mastra, options = { tools: {} }) {
 	});
 	honoServerAdapter.registerContextMiddleware();
 	const serverMiddleware = mastra.getServerMiddleware?.();
-	if (serverMiddleware && serverMiddleware.length > 0) for (const m of serverMiddleware) app.use(m.path, m.handler);
+	if (serverMiddleware && serverMiddleware.length > 0) for (const m of serverMiddleware) app.use(m.path, skipIfFrameworkPublic(m.handler));
 	const browserStreamSetup = options.browserStream === false ? null : await setupBrowserStream(app, {
 		getToolset: async (agentId) => {
 			try {
@@ -4434,7 +4460,7 @@ async function createHonoServer(mastra, options = { tools: {} }) {
 			};
 			return middleware;
 		});
-		for (const middleware of middlewares) app.use(middleware.path, middleware.handler);
+		for (const middleware of middlewares) app.use(middleware.path, skipIfFrameworkPublic(middleware.handler));
 	}
 	await honoServerAdapter.registerCustomApiRoutes();
 	if (server?.build?.apiReqLogs) app.use(logger());