@mastra/deployer 1.82.0 → 1.83.0-alpha.1

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
 import type { Mastra } from '@mastra/core/mastra';
-import type { HonoBindings, HonoVariables } from '../_types/@mastra_hono@1.7.24/dist/index.js';
+import type { HonoBindings, HonoVariables } from '../_types/@mastra_hono@1.7.25-alpha.1/dist/index.js';
 import { Hono } from 'hono';
 import type { ServerBundleOptions } from './types.js';
 type Bindings = HonoBindings;
@@ -13,6 +13,6 @@ export declare function createHonoServer(mastra: Mastra, options?: ServerBundleO
     Bindings: Bindings;
     Variables: Variables;
 }, import("hono/types").BlankSchema, "/">>;
-export declare function createNodeServer(mastra: Mastra, options?: ServerBundleOptions): Promise<import("../_types/@hono_node-server@2.1.5/dist/index.mjs").ServerType>;
+export declare function createNodeServer(mastra: Mastra, options?: ServerBundleOptions): Promise<import("../_types/@hono_node-server@2.1.6/dist/index.mjs").ServerType>;
 export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.js

@@ -1,5 +1,5 @@
-import { d as normalizeStudioBase, n as escapeStudioHtmlValue, o as injectStudioHtmlConfig } from "../utils-C8gwr-ur.js";
 import "../index-CLddUTqr-FaVhUOQu.js";
+import { d as normalizeStudioBase, n as escapeStudioHtmlValue, o as injectStudioHtmlConfig } from "../utils-C8gwr-ur.js";
 import { createReadStream, existsSync, statSync } from "fs";
 import { readFile } from "fs/promises";
 import { dirname, join } from "path";
@@ -31,7 +31,7 @@ import "hono/utils/handler";
 import "hono/utils/url";
 import "hono/validator";
 import { HTTPException } from "hono/http-exception";
-// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@hono/node-server/2.1.5/c64acaa22e289f28d8358ed7eb315e04e16f012a2b67390803ba774efd774a1e/node_modules/@hono/node-server/dist/index.mjs
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@hono/node-server/2.1.6/fdc2ef0c1fce27248082afaacb1b446b5df0c539a71d22f10b0596ee5aa343f0/node_modules/@hono/node-server/dist/index.mjs
 var RequestError = class extends Error {
 	constructor(message, options) {
 		super(message, options);
@@ -189,16 +189,27 @@ const newHeadersFromIncoming = (incoming) => globalThis.Headers === GlobalHeader
 const reValidRequestUrl = /^\/[!#$&-;=?-\[\]_a-z~]*$/;
 const reDotSegment = /\/\.\.?(?:[/?#]|$)/;
 const reValidHost = /^[a-z0-9._-]+(?::(?:[1-5]\d{3,4}|[6-9]\d{3}))?$/;
+const validateRequestTarget = (target) => {
+	const backslash = target.indexOf("\\");
+	if (backslash !== -1) {
+		const query = target.indexOf("?");
+		if (query === -1 || backslash < query) throw new RequestError("Backslash in request path");
+	}
+};
 const buildUrl = (scheme, host, incomingUrl) => {
 	const url = `${scheme}://${host}${incomingUrl}`;
 	if (!reValidHost.test(host)) {
+		validateRequestTarget(incomingUrl);
 		const urlObj = new URL(url);
 		if (urlObj.hostname.length !== host.length && urlObj.hostname !== (host.includes(":") ? host.replace(/:\d+$/, "") : host).toLowerCase()) throw new RequestError("Invalid host header");
 		return urlObj.href;
 	} else if (incomingUrl.length === 0) return url + "/";
 	else {
 		if (incomingUrl.charCodeAt(0) !== 47) throw new RequestError("Invalid URL");
-		if (!reValidRequestUrl.test(incomingUrl) || reDotSegment.test(incomingUrl)) return new URL(url).href;
+		if (!reValidRequestUrl.test(incomingUrl) || reDotSegment.test(incomingUrl)) {
+			validateRequestTarget(incomingUrl);
+			return new URL(url).href;
+		}
 		return url;
 	}
 };
@@ -607,6 +618,7 @@ const newRequest = (incoming, defaultHostname) => {
 	if (incomingUrl[0] !== "/" && (incomingUrl.startsWith("http://") || incomingUrl.startsWith("https://"))) {
 		if (incoming instanceof Http2ServerRequest) throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
 		try {
+			validateRequestTarget(incomingUrl);
 			req[urlKey] = new URL(incomingUrl).href;
 		} catch (e) {
 			throw new RequestError("Invalid absolute URL", { cause: e });
@@ -1147,6 +1159,7 @@ const appendResponseHeaders = (headers, responseHeaders) => {
 	});
 };
 const rejectUpgradeRequest = (socket, status, responseHeaders) => {
+	if (socket.destroyed) return;
 	const responseLines = ["Connection: close", "Content-Length: 0"];
 	appendResponseHeaders(responseLines, responseHeaders);
 	socket.end(`HTTP/1.1 ${status.toString()} ${STATUS_CODES[status] ?? ""}\r\n${responseLines.join("\r\n")}\r\n\r
@@ -1154,7 +1167,12 @@ const rejectUpgradeRequest = (socket, status, responseHeaders) => {
 };
 const createUpgradeRequest = (request) => {
 	const protocol = request.socket.encrypted ? "https" : "http";
-	const url = new URL(request.url ?? "/", `${protocol}://${request.headers.host ?? "localhost"}`);
+	const incomingUrl = request.url ?? "/";
+	let url;
+	if (incomingUrl[0] !== "/" && (incomingUrl.startsWith("http://") || incomingUrl.startsWith("https://"))) {
+		validateRequestTarget(incomingUrl);
+		url = new URL(incomingUrl).href;
+	} else url = buildUrl(protocol, request.headers.host ?? "localhost", incomingUrl);
 	const headers = new Headers();
 	for (const key in request.headers) {
 		const value = request.headers[key];
@@ -1191,6 +1209,10 @@ const setupWebSocket = (options) => {
 	};
 	server.on("upgrade", async (request, socket, head) => {
 		if (request.headers.upgrade?.toLowerCase() !== "websocket") return;
+		const ignoreSocketError = () => {};
+		const reclaimWaiterOnClose = () => rejectWaiter(request);
+		socket.on("error", ignoreSocketError);
+		socket.once("close", reclaimWaiterOnClose);
 		const env = {
 			incoming: request,
 			outgoing: void 0,
@@ -1205,8 +1227,12 @@ const setupWebSocket = (options) => {
 				status = response.status;
 				responseHeaders = response.headers;
 			}
-		} catch {
-			if (server.listenerCount("upgrade") === 1) rejectUpgradeRequest(socket, 500);
+		} catch (error) {
+			if (server.listenerCount("upgrade") === 1) rejectUpgradeRequest(socket, error instanceof RequestError ? 400 : 500);
+			return;
+		}
+		if (socket.destroyed) {
+			rejectWaiter(request);
 			return;
 		}
 		const waiter = waiterMap.get(request);
@@ -1218,12 +1244,11 @@ const setupWebSocket = (options) => {
 		const addResponseHeaders = (headers) => {
 			appendResponseHeaders(headers, responseHeaders);
 		};
-		const reclaimWaiterOnClose = () => rejectWaiter(request);
-		socket.once("close", reclaimWaiterOnClose);
 		wss.on("headers", addResponseHeaders);
 		try {
 			wss.handleUpgrade(request, socket, head, (ws) => {
 				socket.off("close", reclaimWaiterOnClose);
+				socket.off("error", ignoreSocketError);
 				wss.emit("connection", ws, request);
 			});
 		} finally {
@@ -1332,7 +1357,7 @@ const serve = (options, listeningListener) => {
 	});
 	return server;
 };
-// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@hono/node-server/2.1.5/c64acaa22e289f28d8358ed7eb315e04e16f012a2b67390803ba774efd774a1e/node_modules/@hono/node-server/dist/utils/stream.mjs
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@hono/node-server/2.1.6/fdc2ef0c1fce27248082afaacb1b446b5df0c539a71d22f10b0596ee5aa343f0/node_modules/@hono/node-server/dist/utils/stream.mjs
 const pr54206Applied = () => {
 	const [major, minor] = versions.node.split(".").map((component) => parseInt(component));
 	return major >= 23 || major === 22 && minor >= 7 || major === 20 && minor >= 18;
@@ -1390,7 +1415,7 @@ const createStreamBody = (stream, useNativeReadableToWeb = useReadableToWeb) =>
 		}
 	});
 };
-// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@hono/node-server/2.1.5/c64acaa22e289f28d8358ed7eb315e04e16f012a2b67390803ba774efd774a1e/node_modules/@hono/node-server/dist/serve-static.mjs
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@hono/node-server/2.1.6/fdc2ef0c1fce27248082afaacb1b446b5df0c539a71d22f10b0596ee5aa343f0/node_modules/@hono/node-server/dist/serve-static.mjs
 const COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
 const ENCODINGS = {
 	br: ".br",
@@ -1534,7 +1559,7 @@ const serveStatic = (options = { root: "" }) => {
 		return result;
 	};
 };
-// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@hono/swagger-ui/0.5.3/fe1b4a78fef400a9bb4ccec4e91cddbbd9b43706afe50dd3266b2297c015e5bf/node_modules/@hono/swagger-ui/dist/index.js
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@hono/swagger-ui/0.5.3/2d64a3444a8e781b9d0909ff286ca728dbe5419d9721688c851938b2e50a9382/node_modules/@hono/swagger-ui/dist/index.js
 const RENDER_TYPE = {
 	STRING_ARRAY: "string_array",
 	STRING: "string",
@@ -4109,7 +4134,7 @@ var MastraServer$2 = class extends MastraServer {
 		});
 	}
 };
-// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/hono-openapi/1.5.0/aba075f9c000905a9976a3be5624e02cbca659679195a7801fa8cc48a73fcf35/node_modules/hono-openapi/dist/index.js
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/hono-openapi/1.5.0/6ca93514d06afdfd0d7befe948e629b04e66fbf3f0241f2ac71dd8ec9b8121b7/node_modules/hono-openapi/dist/index.js
 const uniqueSymbol = Symbol.for("hono-openapi");
 function describeRoute(spec) {
 	const middleware = async (_c, next) => {