@mastra/deployer 1.79.0-alpha.1 → 1.79.0-alpha.11

package/dist/server/index.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_rolldown_runtime = require("../rolldown-runtime-emK7D4bc.cjs");
-const require_utils = require("../utils-Bsr_sEcH.cjs");
-require("../index-CLddUTqr-DsGkVS-W.cjs");
+const require_rolldown_runtime = require("../rolldown-runtime-Gi87jfEt.cjs");
+const require_utils = require("../utils-C-gJcJAo.cjs");
+require("../index-CLddUTqr-D0GzVJyg.cjs");
 let fs = require("fs");
 let fs_promises = require("fs/promises");
 let path = require("path");
@@ -23,7 +23,7 @@ util = require_rolldown_runtime.__toESM(util, 1);
 let buffer = require("buffer");
 let hono_body_limit = require("hono/body-limit");
 let hono_streaming = require("hono/streaming");
-require("@mastra/core/request-context");
+let _mastra_core_request_context = require("@mastra/core/request-context");
 let _mastra_server_auth = require("@mastra/server/auth");
 let _mastra_server_browser_stream = require("@mastra/server/browser-stream");
 let _mastra_server_a2a_store = require("@mastra/server/a2a/store");
@@ -797,10 +797,10 @@ function writeFromReadableStreamDefaultReader(reader, writable, currentReadPromi
 		}
 	}
 }
-function writeFromReadableStream(stream$3, writable) {
-	if (stream$3.locked) throw new TypeError("ReadableStream is locked.");
+function writeFromReadableStream(stream, writable) {
+	if (stream.locked) throw new TypeError("ReadableStream is locked.");
 	else if (writable.destroyed) return;
-	return writeFromReadableStreamDefaultReader(stream$3.getReader(), writable);
+	return writeFromReadableStreamDefaultReader(stream.getReader(), writable);
 }
 const buildOutgoingHttpHeaders = (headers, defaultContentType) => {
 	const res = {};
@@ -817,7 +817,7 @@ const buildOutgoingHttpHeaders = (headers, defaultContentType) => {
 const outgoingEnded = Symbol("outgoingEnded");
 const incomingDraining = Symbol("incomingDraining");
 const DRAIN_TIMEOUT_MS = 500;
-const MAX_DRAIN_BYTES = 64 * 1024 * 1024;
+const MAX_DRAIN_BYTES = 67108864;
 const drainIncoming = (incoming) => {
 	const incomingWithDrainState = incoming;
 	if (incoming.destroyed || incomingWithDrainState[incomingDraining]) return;
@@ -1405,10 +1405,10 @@ const ENCODINGS = {
 	gzip: ".gz"
 };
 const ENCODINGS_ORDERED_KEYS = Object.keys(ENCODINGS);
-const getStats = (path$3) => {
+const getStats = (path) => {
 	let stats;
 	try {
-		stats = (0, fs.statSync)(path$3);
+		stats = (0, fs.statSync)(path);
 	} catch {}
 	return stats;
 };
@@ -1477,29 +1477,29 @@ const serveStatic = (options = { root: "" }) => {
 			await options.onNotFound?.(c.req.path, c);
 			return next();
 		}
-		let path$4 = (0, path.join)(root, !optionPath && options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename);
-		let stats = getStats(path$4);
+		let path$1 = (0, path.join)(root, !optionPath && options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename);
+		let stats = getStats(path$1);
 		if (stats && stats.isDirectory()) {
 			const indexFile = options.index ?? "index.html";
-			path$4 = (0, path.join)(path$4, indexFile);
-			stats = getStats(path$4);
+			path$1 = (0, path.join)(path$1, indexFile);
+			stats = getStats(path$1);
 		}
 		if (!stats) {
-			await options.onNotFound?.(path$4, c);
+			await options.onNotFound?.(path$1, c);
 			return next();
 		}
-		const mimeType = (0, hono_utils_mime.getMimeType)(path$4);
+		const mimeType = (0, hono_utils_mime.getMimeType)(path$1);
 		c.header("Content-Type", mimeType || "application/octet-stream");
 		if (options.precompressed && (!mimeType || mimeType === "application/octet-stream" || COMPRESSIBLE_CONTENT_TYPE_REGEX.test(mimeType))) {
 			const acceptEncodingSet = new Set(c.req.header("Accept-Encoding")?.split(",").map((encoding) => encoding.trim()));
 			for (const encoding of ENCODINGS_ORDERED_KEYS) {
 				if (!acceptEncodingSet.has(encoding)) continue;
-				const precompressedStats = getStats(path$4 + ENCODINGS[encoding]);
+				const precompressedStats = getStats(path$1 + ENCODINGS[encoding]);
 				if (precompressedStats) {
 					c.header("Content-Encoding", encoding);
 					c.header("Vary", "Accept-Encoding", { append: true });
 					stats = precompressedStats;
-					path$4 = path$4 + ENCODINGS[encoding];
+					path$1 = path$1 + ENCODINGS[encoding];
 					break;
 				}
 			}
@@ -1514,7 +1514,7 @@ const serveStatic = (options = { root: "" }) => {
 			result = c.body(null);
 		} else if (!range) {
 			c.header("Content-Length", size.toString());
-			result = c.body(createStreamBody((0, fs.createReadStream)(path$4)), 200);
+			result = c.body(createStreamBody((0, fs.createReadStream)(path$1)), 200);
 		} else {
 			c.header("Accept-Ranges", "bytes");
 			const resolvedRange = resolveByteRange(parseByteRange(range) ?? {
@@ -1527,7 +1527,7 @@ const serveStatic = (options = { root: "" }) => {
 			} else {
 				const { start, end } = resolvedRange;
 				const chunkSize = end - start + 1;
-				const stream = (0, fs.createReadStream)(path$4, {
+				const stream = (0, fs.createReadStream)(path$1, {
 					start,
 					end
 				});
@@ -1536,7 +1536,7 @@ const serveStatic = (options = { root: "" }) => {
 				result = c.body(createStreamBody(stream), 206);
 			}
 		}
-		await options.onFound?.(path$4, c);
+		await options.onFound?.(path$1, c);
 		return result;
 	};
 };
@@ -1764,13 +1764,15 @@ var ERR_INVALID_ARG_TYPE = class extends TypeError {
 			}
 			if (other.length > 0) msg += " or ";
 		}
-		if (other.length > 0) if (other.length > 2) {
-			const last = other.pop();
-			msg += `one of ${other.join(", ")}, or ${last}`;
-		} else if (other.length === 2) msg += `one of ${other[0]} or ${other[1]}`;
-		else {
-			if (other[0].toLowerCase() !== other[0]) msg += "an ";
-			msg += `${other[0]}`;
+		if (other.length > 0) {
+			if (other.length > 2) {
+				const last = other.pop();
+				msg += `one of ${other.join(", ")}, or ${last}`;
+			} else if (other.length === 2) msg += `one of ${other[0]} or ${other[1]}`;
+			else {
+				if (other[0].toLowerCase() !== other[0]) msg += "an ";
+				msg += `${other[0]}`;
+			}
 		}
 		msg += `. Received ${determineSpecificType(actual)}`;
 		super(msg);
@@ -1971,11 +1973,13 @@ var FetchIncomingMessage = class extends stream.Readable {
 			field = field.slice(1);
 			if (typeof dest[field] === "string") dest[field] += (flag === 0 ? ", " : "; ") + value;
 			else dest[field] = value;
-		} else if (flag === 1) if (dest["set-cookie"] !== void 0) dest["set-cookie"].push(value);
-		else dest["set-cookie"] = [value];
-		else if (this.joinDuplicateHeaders) if (dest[field] === void 0) dest[field] = value;
-		else dest[field] += ", " + value;
-		else if (dest[field] === void 0) dest[field] = value;
+		} else if (flag === 1) {
+			if (dest["set-cookie"] !== void 0) dest["set-cookie"].push(value);
+			else dest["set-cookie"] = [value];
+		} else if (this.joinDuplicateHeaders) {
+			if (dest[field] === void 0) dest[field] = value;
+			else dest[field] += ", " + value;
+		} else if (dest[field] === void 0) dest[field] = value;
 	}
 	_addHeaderLineDistinct(field, value, dest) {
 		field = field.toLowerCase();
@@ -2056,7 +2060,6 @@ function matchKnownFields(field, lowercased = false) {
 		case 19:
 			if (field === "Proxy-Authorization" || field === "proxy-authorization") return "proxy-authorization";
 			if (field === "If-Unmodified-Since" || field === "if-unmodified-since") return "if-unmodified-since";
-			break;
 	}
 	if (lowercased) return "\0" + field;
 	return matchKnownFields(field.toLowerCase(), true);
@@ -2105,7 +2108,7 @@ function utcDate() {
 //#endregion
 //#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/fetch-to-node/2.1.0/75a085586b95f3a18a440f8655a7cb5c851846ab2c5e6ad2c4ae036e3bbaa05c/node_modules/fetch-to-node/dist/fetch-to-node/internal-streams-state.js
 function getDefaultHighWaterMark(objectMode) {
-	return objectMode ? 16 : 64 * 1024;
+	return objectMode ? 16 : 65536;
 }
 //#endregion
 //#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/fetch-to-node/2.1.0/75a085586b95f3a18a440f8655a7cb5c851846ab2c5e6ad2c4ae036e3bbaa05c/node_modules/fetch-to-node/dist/fetch-to-node/http-common.js
@@ -2393,15 +2396,16 @@ var FetchOutgoingMessage = class extends stream.Writable {
 				const entry = headers[key];
 				processHeader(this, state, entry[0], entry[1], false);
 			}
-			else if (Array.isArray(headers)) if (headers.length && Array.isArray(headers[0])) for (let i = 0; i < headers.length; i++) {
-				const entry = headers[i];
-				processHeader(this, state, entry[0], entry[1], true);
-			}
-			else {
-				if (headers.length % 2 !== 0) throw new ERR_INVALID_ARG_VALUE("headers", headers);
-				for (let n = 0; n < headers.length; n += 2) processHeader(this, state, headers[n], headers[n + 1], true);
-			}
-			else for (const key in headers) if (headers.hasOwnProperty(key)) {
+			else if (Array.isArray(headers)) {
+				if (headers.length && Array.isArray(headers[0])) for (let i = 0; i < headers.length; i++) {
+					const entry = headers[i];
+					processHeader(this, state, entry[0], entry[1], true);
+				}
+				else {
+					if (headers.length % 2 !== 0) throw new ERR_INVALID_ARG_VALUE("headers", headers);
+					for (let n = 0; n < headers.length; n += 2) processHeader(this, state, headers[n], headers[n + 1], true);
+				}
+			} else for (const key in headers) if (headers.hasOwnProperty(key)) {
 				const _headers = headers;
 				processHeader(this, state, key, _headers[key], true);
 			}
@@ -2430,13 +2434,15 @@ var FetchOutgoingMessage = class extends stream.Writable {
 				header += "Connection: close\r\n";
 			}
 		}
-		if (!state.contLen && !state.te) if (!this._hasBody) this.chunkedEncoding = false;
-		else if (!this.useChunkedEncodingByDefault) this._last = true;
-		else if (!state.trailer && !this._removedContLen && typeof this._contentLength === "number") header += "Content-Length: " + this._contentLength + "\r\n";
-		else if (!this._removedTE) {
-			header += "Transfer-Encoding: chunked\r\n";
-			this.chunkedEncoding = true;
-		} else this._last = true;
+		if (!state.contLen && !state.te) {
+			if (!this._hasBody) this.chunkedEncoding = false;
+			else if (!this.useChunkedEncodingByDefault) this._last = true;
+			else if (!state.trailer && !this._removedContLen && typeof this._contentLength === "number") header += "Content-Length: " + this._contentLength + "\r\n";
+			else if (!this._removedTE) {
+				header += "Transfer-Encoding: chunked\r\n";
+				this.chunkedEncoding = true;
+			} else this._last = true;
+		}
 		if (this.chunkedEncoding !== true && state.trailer) throw new ERR_HTTP_TRAILER_INVALID();
 		this._header = header + "\r\n";
 		this._headerSent = false;
@@ -2580,9 +2586,7 @@ var FetchOutgoingMessage = class extends stream.Writable {
 			case "transfer-encoding":
 				this._removedTE = true;
 				break;
-			case "date":
-				this.sendDate = false;
-				break;
+			case "date": this.sendDate = false;
 		}
 		if (this[kOutHeaders] !== null) delete this[kOutHeaders][key];
 	}
@@ -2653,8 +2657,10 @@ var FetchOutgoingMessage = class extends stream.Writable {
 			if (this._writtenDataBuffer != null) this._writtenDataBuffer.cork();
 			write_(this, chunk, encoding, null, true);
 		} else if (this.finished) {
-			if (typeof callback === "function") if (!this.writableFinished) this.on("finish", callback);
-			else callback(new ERR_STREAM_ALREADY_FINISHED("end"));
+			if (typeof callback === "function") {
+				if (!this.writableFinished) this.on("finish", callback);
+				else callback(new ERR_STREAM_ALREADY_FINISHED("end"));
+			}
 			return this;
 		} else if (!this._header) {
 			if (this._writtenDataBuffer != null) this._writtenDataBuffer.cork();
@@ -2719,8 +2725,10 @@ var FetchOutgoingMessage = class extends stream.Writable {
 };
 function processHeader(self, state, key, value, validate) {
 	if (validate) validateHeaderName(key);
-	if (isContentDispositionField(key) && self._contentLength) if (Array.isArray(value)) for (let i = 0; i < value.length; i++) value[i] = String(buffer.Buffer.from(String(value[i]), "latin1"));
-	else value = String(buffer.Buffer.from(String(value), "latin1"));
+	if (isContentDispositionField(key) && self._contentLength) {
+		if (Array.isArray(value)) for (let i = 0; i < value.length; i++) value[i] = String(buffer.Buffer.from(String(value[i]), "latin1"));
+		else value = String(buffer.Buffer.from(String(value), "latin1"));
+	}
 	if (Array.isArray(value)) {
 		if ((value.length < 2 || !isCookieField(key)) && (!self[kUniqueHeaders] || !self[kUniqueHeaders].has(key.toLowerCase()))) {
 			for (let i = 0; i < value.length; i++) storeHeader(self, state, key, value[i], validate);
@@ -2770,9 +2778,7 @@ function matchHeader(self, state, field, value) {
 		case "trailer":
 			state[field] = true;
 			break;
-		case "keep-alive":
-			self._defaultKeepAlive = false;
-			break;
+		case "keep-alive": self._defaultKeepAlive = false;
 	}
 }
 function onError(msg, err, callback) {
@@ -2815,10 +2821,12 @@ function write_(msg, chunk, encoding, callback, fromEnd) {
 		}
 		msg._implicitHeader();
 	}
-	if (!msg._hasBody) if (msg[kRejectNonStandardBodyWrites]) throw new ERR_HTTP_BODY_NOT_ALLOWED();
-	else {
-		setTimeout(callback, 0);
-		return true;
+	if (!msg._hasBody) {
+		if (msg[kRejectNonStandardBodyWrites]) throw new ERR_HTTP_BODY_NOT_ALLOWED();
+		else {
+			setTimeout(callback, 0);
+			return true;
+		}
 	}
 	if (!fromEnd && msg._writtenDataBuffer != null && !msg._writtenDataBuffer.writableCorked) {
 		msg._writtenDataBuffer.cork();
@@ -3016,8 +3024,10 @@ var FetchServerResponse = class FetchServerResponse extends FetchOutgoingMessage
 			}
 			data = data.slice(this.writtenHeaderBytes);
 		}
-		if (typeof data === "string") if (encoding === void 0 || encoding === "utf8" || encoding === "utf-8") data = FetchServerResponse.encoder.encode(data);
-		else data = buffer.Buffer.from(data, encoding ?? void 0);
+		if (typeof data === "string") {
+			if (encoding === void 0 || encoding === "utf8" || encoding === "utf-8") data = FetchServerResponse.encoder.encode(data);
+			else data = buffer.Buffer.from(data, encoding ?? void 0);
+		}
 		return data ?? buffer.Buffer.from([]);
 	}
 	_finish() {
@@ -3201,6 +3211,191 @@ function propagateClientDisconnect(fetchResponse, res) {
 		headers: fetchResponse.headers
 	});
 }
+function createAuthMiddleware({ mastra, requiresAuth = true }) {
+	return async (c, next) => {
+		if (!requiresAuth) return next();
+		const authConfig = mastra.getServer()?.auth;
+		if (!authConfig) return next();
+		const requestContext = c.get("requestContext") ?? new _mastra_core_request_context.RequestContext();
+		c.set("requestContext", requestContext);
+		c.set("mastra", c.get("mastra") ?? mastra);
+		const path = c.req.path;
+		const method = c.req.method;
+		const customRouteAuthConfig = new Map(c.get("customRouteAuthConfig") ?? []);
+		if (!(0, _mastra_server_auth.isCustomRoutePublic)(path, method, customRouteAuthConfig)) customRouteAuthConfig.set(`${method}:${path}`, true);
+		const authHeader = c.req.header("Authorization");
+		let token = authHeader ? authHeader.replace("Bearer ", "") : null;
+		if (!token) token = c.req.query("apiKey") || null;
+		const result = await (0, _mastra_server_auth.coreAuthMiddleware)({
+			path,
+			method,
+			getHeader: (name) => c.req.header(name),
+			mastra,
+			authConfig,
+			customRouteAuthConfig,
+			requestContext,
+			rawRequest: c.req.raw,
+			token,
+			buildAuthorizeContext: () => c
+		});
+		for (const [key, value] of Object.entries(result.headers ?? {})) c.header(key, value, key.toLowerCase() === "set-cookie" ? { append: true } : void 0);
+		if (result.action === "next") return next();
+		return c.json(result.body, result.status);
+	};
+}
+const TICKET_BYTES = 32;
+/**
+* How long an issued ticket stays valid. A ticket is minted immediately before
+* the socket is opened, so this only has to cover the round trip plus the
+* handshake — short enough that a ticket leaked from a log is useless by the
+* time anyone can act on it.
+*/
+const UPGRADE_TICKET_TTL_MS = 3e4;
+/**
+* Ceiling on tracked per-agent issuance counters, so the limiter can't grow
+* without bound as agent ids are invented. Counters are evicted oldest first.
+*/
+const MAX_TRACKED_AGENTS = 500;
+/** 256 bits of base64url, so the ticket can't be guessed or enumerated. */
+function createTicketValue() {
+	const bytes = new Uint8Array(TICKET_BYTES);
+	globalThis.crypto.getRandomValues(bytes);
+	return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/**
+* Short-lived, single-use credentials for browser WebSocket upgrades.
+*
+* A browser cannot set an `Authorization` header on a WebSocket handshake, so a
+* deployment that authenticates with a header token would otherwise have to put
+* that reusable token in the handshake URL, where proxies and access logs can
+* retain it. Instead the client asks an authenticated HTTP route for a ticket,
+* and the ticket — worthless once spent, and scoped to one agent and thread —
+* travels in the URL instead.
+*
+* In-process, like the `ViewerRegistry` and the browser sessions it serves: a
+* screencast is bound to the process holding the browser, so a ticket store
+* shared across replicas would buy nothing. A ticket presented to a different
+* replica fails for the same reason the stream itself would.
+*
+* Issuance is bounded so the mint endpoint can't be turned into memory or CPU
+* exhaustion: tickets that are never spent live at most one TTL, a full store
+* rejects instead of growing, and each agent has a request allowance. Expiry is
+* swept from the front of the insertion-ordered map, so cleanup costs the
+* number of entries actually expired rather than a scan of every outstanding
+* ticket per request.
+*/
+var UpgradeTicketStore = class {
+	#tickets = /* @__PURE__ */ new Map();
+	#issuance = /* @__PURE__ */ new Map();
+	#now;
+	constructor(now = () => Date.now()) {
+		this.#now = now;
+	}
+	/**
+	* Issue a ticket bound to one agent and thread. Returns `{ ok: false }` when
+	* the agent exceeded its allowance or the store is at capacity.
+	*/
+	issue(agentId, threadId, ttlMs = UPGRADE_TICKET_TTL_MS) {
+		const now = this.#now();
+		this.#prune(now);
+		if (this.#tickets.size >= 500) return {
+			ok: false,
+			reason: "capacity"
+		};
+		const window = this.#issuance.get(agentId);
+		if (!window || now - window.windowStart >= 6e4) this.#trackIssuance(agentId, {
+			windowStart: now,
+			count: 0
+		});
+		else if (window.count >= 30) return {
+			ok: false,
+			reason: "rate-limited"
+		};
+		this.#issuance.get(agentId).count += 1;
+		const ticket = createTicketValue();
+		this.#tickets.set(ticket, {
+			agentId,
+			threadId,
+			expiresAt: now + ttlMs
+		});
+		return {
+			ok: true,
+			ticket,
+			expiresIn: Math.ceil(ttlMs / 1e3)
+		};
+	}
+	/**
+	* Spend a ticket. Returns `true` only when the ticket is unexpired and was
+	* issued for this exact agent and thread, in which case it is consumed and a
+	* second presentation fails.
+	*/
+	consume(ticket, agentId, threadId) {
+		const entry = this.#tickets.get(ticket);
+		if (!entry) return false;
+		if (entry.expiresAt <= this.#now()) return false;
+		if (entry.agentId !== agentId) return false;
+		if ((entry.threadId ?? void 0) !== (threadId ?? void 0)) return false;
+		this.#tickets.delete(ticket);
+		return true;
+	}
+	/**
+	* Drop expired tickets from the front of the insertion-ordered map. Tickets
+	* are inserted in issue order and share a TTL, so the entries after the first
+	* live one are live too and the sweep can stop there.
+	*/
+	#prune(now) {
+		for (const [ticket, entry] of this.#tickets) {
+			if (entry.expiresAt > now) break;
+			this.#tickets.delete(ticket);
+		}
+	}
+	/** Record an issuance window, evicting the oldest counter when at the cap. */
+	#trackIssuance(agentId, window) {
+		this.#issuance.delete(agentId);
+		this.#issuance.set(agentId, window);
+		if (this.#issuance.size > MAX_TRACKED_AGENTS) {
+			const oldest = this.#issuance.keys().next().value;
+			if (oldest !== void 0) this.#issuance.delete(oldest);
+		}
+	}
+};
+const TICKET_BODY_MAX_BYTES = 4096;
+/**
+* Resolve an `allowedOrigins` value against the request's `Origin` header.
+*
+* Mirrors Hono's `cors.origin` semantics so the same config value means the same
+* thing on the upgrade as it does on the HTTP routes: `'*'` allows everything,
+* array entries match literally, and a callback is only an approval when it
+* returns the request's own origin (the value Hono would echo back) or `'*'`.
+*/
+async function isOriginAllowed(allowedOrigins, origin, c) {
+	if (Array.isArray(allowedOrigins)) return allowedOrigins.includes(origin);
+	if (typeof allowedOrigins === "function") {
+		const allowed = await allowedOrigins(origin, c);
+		return allowed === origin || allowed === "*";
+	}
+	return allowedOrigins === "*" || allowedOrigins === origin;
+}
+/**
+* Is the `Origin` header the server's own origin?
+*
+* A Studio served by this server connects back to the same host, and operators
+* don't add their own origin to a CORS allowlist because same-origin requests
+* never needed CORS. Comparing hosts (rather than scheme + host) keeps that
+* working behind TLS-terminating proxies, where the server sees `http` while the
+* browser sends `https`.
+*/
+function isSameOrigin(origin, requestHost) {
+	if (!requestHost) return false;
+	let originHost;
+	try {
+		originHost = new URL(origin).host;
+	} catch {
+		return false;
+	}
+	const host = (requestHost.split(",")[0] ?? "").trim();
+	return originHost !== "" && originHost.toLowerCase() === host.toLowerCase();
+}
 /**
 * Set up WebSocket-based browser stream endpoint for real-time screencast viewing.
 *
@@ -3210,6 +3405,17 @@ function propagateClientDisconnect(fetchResponse, res) {
 * - Broadcasts frames to all connected viewers
 * - Stops screencast when last viewer disconnects
 *
+* All routes are authenticated with the server's auth configuration. Browsers
+* cannot attach an `Authorization` header to a WebSocket upgrade, so
+* session-cookie providers authenticate from the upgrade request's cookies.
+* Clients that authenticate with a header token instead request a short-lived,
+* single-use ticket from `POST ${apiPrefix}/agents/:agentId/browser/stream-ticket`
+* and pass it to the upgrade as `?ticket=`, which keeps the reusable credential
+* out of the URL. Non-browser clients can pass the token as the `apiKey` query
+* parameter — use a short-lived token, since a URL can be retained in proxy and
+* access logs, and prefer the `Authorization` header on the HTTP routes where the
+* client can set one.
+*
 * **Note**: Requires `ws` package to be installed. If not available, returns null
 * and logs a warning. Browser streaming will be disabled but everything else works.
 *
@@ -3225,6 +3431,7 @@ function propagateClientDisconnect(fetchResponse, res) {
 *
 * const app = new Hono();
 * const browserStream = await setupBrowserStream(app, {
+*   mastra,
 *   getToolset: (agentId) => browserToolsets.get(agentId),
 * });
 *
@@ -3247,7 +3454,24 @@ async function setupBrowserStream(app, config) {
 	const registry = new _mastra_server_browser_stream.ViewerRegistry();
 	const rawPrefix = config.apiPrefix ?? "/api";
 	const apiPrefix = (rawPrefix.endsWith("/") ? rawPrefix.slice(0, -1) : rawPrefix) || "/api";
-	app.get("/browser/:agentId/stream", upgradeWebSocket((c) => {
+	const authenticate = createAuthMiddleware({ mastra: config.mastra });
+	const upgradeTickets = new UpgradeTicketStore();
+	const authorizeUpgrade = async (c, next) => {
+		const ticket = c.req.query("ticket");
+		if (!ticket) return authenticate(c, next);
+		const agentId = c.req.param("agentId");
+		if (!upgradeTickets.consume(ticket, agentId, c.req.query("threadId"))) return c.json({ error: "Invalid or expired upgrade ticket" }, 401);
+		return next();
+	};
+	const allowedOrigins = config.allowedOrigins;
+	const checkOrigin = async (c, next) => {
+		const origin = c.req.header("origin");
+		if (!allowedOrigins || !origin) return next();
+		if (isSameOrigin(origin, c.req.header("x-forwarded-host") ?? c.req.header("host"))) return next();
+		if (!await isOriginAllowed(allowedOrigins, origin, c)) return c.text("Forbidden", 403);
+		return next();
+	};
+	app.get("/browser/:agentId/stream", checkOrigin, authorizeUpgrade, upgradeWebSocket((c) => {
 		const agentId = c.req.param("agentId");
 		const threadId = c.req.query("threadId");
 		const viewerKey = threadId ? `${agentId}:${threadId}` : agentId;
@@ -3269,7 +3493,29 @@ async function setupBrowserStream(app, config) {
 			}
 		};
 	}));
-	app.get(`${apiPrefix}/agents/:agentId/browser/session`, async (c) => {
+	const ticketBodyLimit = (0, hono_body_limit.bodyLimit)({
+		maxSize: TICKET_BODY_MAX_BYTES,
+		onError: (c) => c.json({ error: "Request body too large" }, 413)
+	});
+	app.post(`${apiPrefix}/agents/:agentId/browser/stream-ticket`, authenticate, ticketBodyLimit, async (c) => {
+		const agentId = c.req.param("agentId");
+		if (!agentId) return c.json({ error: "Agent ID is required" }, 400);
+		let threadId = c.req.query("threadId");
+		try {
+			const body = await c.req.json();
+			if (!threadId && typeof body?.threadId === "string") threadId = body.threadId;
+		} catch {}
+		const issued = upgradeTickets.issue(agentId, threadId);
+		if (!issued.ok) {
+			const error = issued.reason === "capacity" ? "Too many outstanding browser stream upgrade tickets" : "Too many browser stream upgrade tickets requested";
+			return c.json({ error }, 429);
+		}
+		return c.json({
+			ticket: issued.ticket,
+			expiresIn: issued.expiresIn
+		});
+	});
+	app.get(`${apiPrefix}/agents/:agentId/browser/session`, authenticate, async (c) => {
 		const agentId = c.req.param("agentId");
 		if (!agentId) return c.json({ error: "Agent ID is required" }, 400);
 		const threadId = c.req.query("threadId");
@@ -3284,7 +3530,7 @@ async function setupBrowserStream(app, config) {
 			screencastAvailable: true
 		});
 	});
-	app.post(`${apiPrefix}/agents/:agentId/browser/close`, async (c) => {
+	app.post(`${apiPrefix}/agents/:agentId/browser/close`, authenticate, ticketBodyLimit, async (c) => {
 		const agentId = c.req.param("agentId");
 		if (!agentId) return c.json({ error: "Agent ID is required" }, 400);
 		const toolset = await config.getToolset(agentId);
@@ -3896,7 +4142,7 @@ var MastraServer = class extends _mastra_server_server_adapter.MastraServer {
 	}
 };
 //#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/hono-openapi/1.3.1/2557b2465f29e88b77390131b99b4ae79c844dd5b524b41cc78f5b3bfa1fdf70/node_modules/hono-openapi/dist/index.js
+//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/hono-openapi/1.3.1/158235e7235efea6160a30c3ca102ac021a6d2f9183c16a3ddab0c84f82188b4/node_modules/hono-openapi/dist/index.js
 const uniqueSymbol = Symbol("openapi");
 function describeRoute(spec) {
 	const middleware = async (_c, next) => {
@@ -4596,9 +4842,12 @@ function welcomeHtml(apiPrefix = "/api") {
 //#region src/server/index.ts
 const getStudioPath = () => {
 	if (process.env.MASTRA_STUDIO_PATH) return process.env.MASTRA_STUDIO_PATH;
-	let __dirname = ".";
-	if (require("url").pathToFileURL(__filename).href) __dirname = (0, path.dirname)((0, url.fileURLToPath)(require("url").pathToFileURL(__filename).href));
-	return process.env.MASTRA_STUDIO_PATH || (0, path.join)(__dirname, "studio");
+	let __dirname$1 = ".";
+	if (require("url").pathToFileURL(__filename).href) {
+		const __filename$1 = (0, url.fileURLToPath)(require("url").pathToFileURL(__filename).href);
+		__dirname$1 = (0, path.dirname)(__filename$1);
+	}
+	return process.env.MASTRA_STUDIO_PATH || (0, path.join)(__dirname$1, "studio");
 };
 function isSchemaApiRoute(route) {
 	return "_mastraSchemaRoute" in route && route._mastraSchemaRoute === true;
@@ -4683,7 +4932,7 @@ async function createHonoServer(mastra, options = { tools: {} }) {
 		return errorHandler(err, c, options.isDev);
 	});
 	const bodyLimitOptions = {
-		maxSize: server?.bodySizeLimit ?? 4.5 * 1024 * 1024,
+		maxSize: server?.bodySizeLimit ?? 4718592,
 		onError: () => ({ error: "Request body too large" })
 	};
 	const honoServerAdapter = new MastraServer({
@@ -4701,7 +4950,10 @@ async function createHonoServer(mastra, options = { tools: {} }) {
 	honoServerAdapter.registerContextMiddleware();
 	const serverMiddleware = mastra.getServerMiddleware?.();
 	if (serverMiddleware && serverMiddleware.length > 0) for (const m of serverMiddleware) app.use(m.path, skipIfFrameworkPublic(m.handler));
+	const browserStreamOrigins = server?.cors && typeof server.cors === "object" && "origin" in server.cors ? server.cors.origin : void 0;
 	const browserStreamSetup = options.browserStream === false ? null : await setupBrowserStream(app, {
+		mastra,
+		allowedOrigins: browserStreamOrigins,
 		getToolset: async (agentId) => {
 			const resolveBrowser = async (agent) => {
 				if (!agent) return void 0;
@@ -4728,14 +4980,15 @@ async function createHonoServer(mastra, options = { tools: {} }) {
 		hasSession: false,
 		screencastAvailable: false
 	}));
-	if (server?.cors === false) app.use("*", (0, hono_timeout.timeout)(server?.timeout ?? 180 * 1e3));
+	if (server?.cors === false) app.use("*", (0, hono_timeout.timeout)(server?.timeout ?? 18e4));
 	else {
 		const hasAuth = !!server?.auth;
-		app.use("*", (0, hono_timeout.timeout)(server?.timeout ?? 180 * 1e3), async (c, next) => {
+		app.use("*", (0, hono_timeout.timeout)(server?.timeout ?? 18e4), async (c, next) => {
 			const pathname = new URL(c.req.url).pathname;
 			const method = c.req.method === "OPTIONS" ? c.req.header("Access-Control-Request-Method") ?? c.req.method : c.req.method;
 			const routeCors = getRouteCorsConfig(processedRoutes, pathname, method);
-			return (0, hono_cors.cors)(routeCors ? getCorsConfig(routeCors, false) : getCorsConfig(server?.cors, hasAuth))(c, next);
+			const corsOptions = routeCors ? getCorsConfig(routeCors, false) : getCorsConfig(server?.cors, hasAuth);
+			return (0, hono_cors.cors)(corsOptions)(c, next);
 		});
 	}
 	app.get("/health", describeRoute({
@@ -4804,8 +5057,8 @@ async function createHonoServer(mastra, options = { tools: {} }) {
 		const studioPath = getStudioPath();
 		app.use(`${studioBasePath}/assets/*`, serveStatic({
 			root: (0, path.join)(studioPath, "assets"),
-			rewriteRequestPath: (path$1) => {
-				let rewritten = path$1;
+			rewriteRequestPath: (path) => {
+				let rewritten = path;
 				if (studioBasePath && rewritten.startsWith(studioBasePath)) rewritten = rewritten.slice(studioBasePath.length);
 				if (rewritten.startsWith("/assets")) rewritten = rewritten.slice(7);
 				return rewritten;
@@ -4818,7 +5071,8 @@ async function createHonoServer(mastra, options = { tools: {} }) {
 		if (requestPath.includes(".") && !requestPath.endsWith(".html")) return await next();
 		const isStudioRoute = studioBasePath === "" || requestPath === studioBasePath || requestPath.startsWith(`${studioBasePath}/`);
 		if (options?.studio && isStudioRoute) {
-			let indexHtml = await (0, fs_promises.readFile)((0, path.join)(getStudioPath(), "index.html"), "utf-8");
+			const studioPath = getStudioPath();
+			let indexHtml = await (0, fs_promises.readFile)((0, path.join)(studioPath, "index.html"), "utf-8");
 			const port = serverOptions?.port ?? (Number(process.env.PORT) || 4111);
 			const hideCloudCta = process.env.MASTRA_HIDE_CLOUD_CTA === "true";
 			const host = serverOptions?.host ?? process.env.MASTRA_HOST ?? "localhost";
@@ -4869,9 +5123,9 @@ async function createHonoServer(mastra, options = { tools: {} }) {
 		const studioPath = studioBasePath ? `${studioBasePath}/*` : "*";
 		app.use(studioPath, serveStatic({
 			root: studioRootPath,
-			rewriteRequestPath: (path$2) => {
-				if (studioBasePath && path$2.startsWith(studioBasePath)) return path$2.slice(studioBasePath.length);
-				return path$2;
+			rewriteRequestPath: (path) => {
+				if (studioBasePath && path.startsWith(studioBasePath)) return path.slice(studioBasePath.length);
+				return path;
 			}
 		}));
 	}