@mastra/deployer 1.82.0-alpha.3 → 1.83.0-alpha.0

package/dist/rolldown-runtime-CO0Nlsmt.js

@@ -0,0 +1,23 @@
+// \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod, mod.exports), cb = null), mod.exports);
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+export { __toESM as n, __commonJSMin as t };

package/dist/server/index.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("../rolldown-runtime-Bc0pwXKd.cjs");
-const require_utils = require("../utils-CDNA_ewa.cjs");
 require("../index-CLddUTqr-CeV0aeBL.cjs");
+const require_utils = require("../utils-CDNA_ewa.cjs");
 let fs = require("fs");
 let fs_promises = require("fs/promises");
 let path = require("path");
@@ -36,7 +36,7 @@ require("hono/utils/handler");
 require("hono/utils/url");
 require("hono/validator");
 let hono_http_exception = require("hono/http-exception");
-// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@hono/node-server/2.1.5/c64acaa22e289f28d8358ed7eb315e04e16f012a2b67390803ba774efd774a1e/node_modules/@hono/node-server/dist/index.mjs
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@hono/node-server/2.1.6/fdc2ef0c1fce27248082afaacb1b446b5df0c539a71d22f10b0596ee5aa343f0/node_modules/@hono/node-server/dist/index.mjs
 var RequestError = class extends Error {
 	constructor(message, options) {
 		super(message, options);
@@ -194,16 +194,27 @@ const newHeadersFromIncoming = (incoming) => globalThis.Headers === GlobalHeader
 const reValidRequestUrl = /^\/[!#$&-;=?-\[\]_a-z~]*$/;
 const reDotSegment = /\/\.\.?(?:[/?#]|$)/;
 const reValidHost = /^[a-z0-9._-]+(?::(?:[1-5]\d{3,4}|[6-9]\d{3}))?$/;
+const validateRequestTarget = (target) => {
+	const backslash = target.indexOf("\\");
+	if (backslash !== -1) {
+		const query = target.indexOf("?");
+		if (query === -1 || backslash < query) throw new RequestError("Backslash in request path");
+	}
+};
 const buildUrl = (scheme, host, incomingUrl) => {
 	const url = `${scheme}://${host}${incomingUrl}`;
 	if (!reValidHost.test(host)) {
+		validateRequestTarget(incomingUrl);
 		const urlObj = new URL(url);
 		if (urlObj.hostname.length !== host.length && urlObj.hostname !== (host.includes(":") ? host.replace(/:\d+$/, "") : host).toLowerCase()) throw new RequestError("Invalid host header");
 		return urlObj.href;
 	} else if (incomingUrl.length === 0) return url + "/";
 	else {
 		if (incomingUrl.charCodeAt(0) !== 47) throw new RequestError("Invalid URL");
-		if (!reValidRequestUrl.test(incomingUrl) || reDotSegment.test(incomingUrl)) return new URL(url).href;
+		if (!reValidRequestUrl.test(incomingUrl) || reDotSegment.test(incomingUrl)) {
+			validateRequestTarget(incomingUrl);
+			return new URL(url).href;
+		}
 		return url;
 	}
 };
@@ -612,6 +623,7 @@ const newRequest = (incoming, defaultHostname) => {
 	if (incomingUrl[0] !== "/" && (incomingUrl.startsWith("http://") || incomingUrl.startsWith("https://"))) {
 		if (incoming instanceof http2.Http2ServerRequest) throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
 		try {
+			validateRequestTarget(incomingUrl);
 			req[urlKey] = new URL(incomingUrl).href;
 		} catch (e) {
 			throw new RequestError("Invalid absolute URL", { cause: e });
@@ -1152,6 +1164,7 @@ const appendResponseHeaders = (headers, responseHeaders) => {
 	});
 };
 const rejectUpgradeRequest = (socket, status, responseHeaders) => {
+	if (socket.destroyed) return;
 	const responseLines = ["Connection: close", "Content-Length: 0"];
 	appendResponseHeaders(responseLines, responseHeaders);
 	socket.end(`HTTP/1.1 ${status.toString()} ${http.STATUS_CODES[status] ?? ""}\r\n${responseLines.join("\r\n")}\r\n\r
@@ -1159,7 +1172,12 @@ const rejectUpgradeRequest = (socket, status, responseHeaders) => {
 };
 const createUpgradeRequest = (request) => {
 	const protocol = request.socket.encrypted ? "https" : "http";
-	const url = new URL(request.url ?? "/", `${protocol}://${request.headers.host ?? "localhost"}`);
+	const incomingUrl = request.url ?? "/";
+	let url;
+	if (incomingUrl[0] !== "/" && (incomingUrl.startsWith("http://") || incomingUrl.startsWith("https://"))) {
+		validateRequestTarget(incomingUrl);
+		url = new URL(incomingUrl).href;
+	} else url = buildUrl(protocol, request.headers.host ?? "localhost", incomingUrl);
 	const headers = new Headers();
 	for (const key in request.headers) {
 		const value = request.headers[key];
@@ -1196,6 +1214,10 @@ const setupWebSocket = (options) => {
 	};
 	server.on("upgrade", async (request, socket, head) => {
 		if (request.headers.upgrade?.toLowerCase() !== "websocket") return;
+		const ignoreSocketError = () => {};
+		const reclaimWaiterOnClose = () => rejectWaiter(request);
+		socket.on("error", ignoreSocketError);
+		socket.once("close", reclaimWaiterOnClose);
 		const env = {
 			incoming: request,
 			outgoing: void 0,
@@ -1210,8 +1232,12 @@ const setupWebSocket = (options) => {
 				status = response.status;
 				responseHeaders = response.headers;
 			}
-		} catch {
-			if (server.listenerCount("upgrade") === 1) rejectUpgradeRequest(socket, 500);
+		} catch (error) {
+			if (server.listenerCount("upgrade") === 1) rejectUpgradeRequest(socket, error instanceof RequestError ? 400 : 500);
+			return;
+		}
+		if (socket.destroyed) {
+			rejectWaiter(request);
 			return;
 		}
 		const waiter = waiterMap.get(request);
@@ -1223,12 +1249,11 @@ const setupWebSocket = (options) => {
 		const addResponseHeaders = (headers) => {
 			appendResponseHeaders(headers, responseHeaders);
 		};
-		const reclaimWaiterOnClose = () => rejectWaiter(request);
-		socket.once("close", reclaimWaiterOnClose);
 		wss.on("headers", addResponseHeaders);
 		try {
 			wss.handleUpgrade(request, socket, head, (ws) => {
 				socket.off("close", reclaimWaiterOnClose);
+				socket.off("error", ignoreSocketError);
 				wss.emit("connection", ws, request);
 			});
 		} finally {
@@ -1337,7 +1362,7 @@ const serve = (options, listeningListener) => {
 	});
 	return server;
 };
-// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@hono/node-server/2.1.5/c64acaa22e289f28d8358ed7eb315e04e16f012a2b67390803ba774efd774a1e/node_modules/@hono/node-server/dist/utils/stream.mjs
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@hono/node-server/2.1.6/fdc2ef0c1fce27248082afaacb1b446b5df0c539a71d22f10b0596ee5aa343f0/node_modules/@hono/node-server/dist/utils/stream.mjs
 const pr54206Applied = () => {
 	const [major, minor] = process$1.versions.node.split(".").map((component) => parseInt(component));
 	return major >= 23 || major === 22 && minor >= 7 || major === 20 && minor >= 18;
@@ -1395,7 +1420,7 @@ const createStreamBody = (stream$2, useNativeReadableToWeb = useReadableToWeb) =
 		}
 	});
 };
-// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@hono/node-server/2.1.5/c64acaa22e289f28d8358ed7eb315e04e16f012a2b67390803ba774efd774a1e/node_modules/@hono/node-server/dist/serve-static.mjs
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@hono/node-server/2.1.6/fdc2ef0c1fce27248082afaacb1b446b5df0c539a71d22f10b0596ee5aa343f0/node_modules/@hono/node-server/dist/serve-static.mjs
 const COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
 const ENCODINGS = {
 	br: ".br",
@@ -1539,7 +1564,7 @@ const serveStatic = (options = { root: "" }) => {
 		return result;
 	};
 };
-// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@hono/swagger-ui/0.5.3/fe1b4a78fef400a9bb4ccec4e91cddbbd9b43706afe50dd3266b2297c015e5bf/node_modules/@hono/swagger-ui/dist/index.js
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@hono/swagger-ui/0.5.3/2d64a3444a8e781b9d0909ff286ca728dbe5419d9721688c851938b2e50a9382/node_modules/@hono/swagger-ui/dist/index.js
 const RENDER_TYPE = {
 	STRING_ARRAY: "string_array",
 	STRING: "string",
@@ -4114,7 +4139,7 @@ var MastraServer = class extends _mastra_server_server_adapter.MastraServer {
 		});
 	}
 };
-// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/hono-openapi/1.5.0/aba075f9c000905a9976a3be5624e02cbca659679195a7801fa8cc48a73fcf35/node_modules/hono-openapi/dist/index.js
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/hono-openapi/1.5.0/6ca93514d06afdfd0d7befe948e629b04e66fbf3f0241f2ac71dd8ec9b8121b7/node_modules/hono-openapi/dist/index.js
 const uniqueSymbol = Symbol.for("hono-openapi");
 function describeRoute(spec) {
 	const middleware = async (_c, next) => {