@mastra/server-adapters-test-suite 0.1.3-alpha.2 → 0.1.4-alpha.0

package/dist/index.js

@@ -1,4 +1,5 @@
 import { ErrorCategory, ErrorDomain, MastraError } from "@mastra/core/error";
+import { registerApiRoute } from "@mastra/core/server";
 import { handleError } from "@mastra/server/handlers/error";
 import { HTTPException, SERVER_ROUTES, WorkflowRegistry, createRoute } from "@mastra/server/server-adapter";
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
@@ -23,8 +24,9 @@ import { MastraVector } from "@mastra/core/vector";
 import { CompositeVoice } from "@mastra/core/voice";
 import { createStep, createWorkflow } from "@mastra/core/workflows";
 import { LocalFilesystem, Workspace } from "@mastra/core/workspace";
-import { MCPClient, MCPServer } from "@mastra/mcp";
+import { MCPClient, MCPServer, defineEvent } from "@mastra/mcp";
 import { Mastra as Mastra$1 } from "@mastra/core/mastra";
+import http from "http";
 import { MCPServerBase } from "@mastra/core/mcp";
 import { RequestContext } from "@mastra/core/request-context";
 import { standardSchemaToJSONSchema } from "@mastra/core/schema";
@@ -59,6 +61,8 @@ function getRouteSpecificSchemaDefaults(route) {
 		predicateScope: "trace",
 		path: "entityName"
 	} };
+	if (route.path === "/agent-controller/:controllerId/sessions" && route.method === "POST") return { body: { resourceId: "test-resource" } };
+	if (route.path === "/mcp/:serverId/events/:eventName/emit") return { body: { data: { id: "test-ticket" } } };
 	if (route.path === "/datasets/:datasetId/compare") return { body: {
 		experimentIds: ["test-experiment-a", "test-experiment-b"],
 		baselineId: "test-experiment-a"
@@ -136,8 +140,10 @@ function generateValidDataFromSchema(schema, fieldName) {
 		def = getZodDef(schema);
 	}
 	if (typeName === "ZodOptional" || typeName === "ZodNullable") return generateValidDataFromSchema(def.innerType, fieldName);
-	if (typeName === "ZodDefault") if ("_zod" in schema) return def.defaultValue;
-	else return def.defaultValue();
+	if (typeName === "ZodDefault") {
+		if ("_zod" in schema) return def.defaultValue;
+		else return def.defaultValue();
+	}
 	if (typeName === "ZodString") {
 		if ((def.checks ?? []).some((check) => {
 			const checkDef = check._zod?.def ?? check.def ?? check;
@@ -235,13 +241,19 @@ function generateValidDataFromSchema(schema, fieldName) {
 	if (typeName === "ZodUndefined") return void 0;
 	if (typeName === "ZodDate") return /* @__PURE__ */ new Date();
 	if (typeName === "ZodBigInt") return BigInt(0);
-	if (typeName === "ZodLiteral") if ("_zod" in schema) return def.values?.[0];
-	else return def.value;
-	if (typeName === "ZodEnum") if ("_zod" in schema) return Object.values(def.entries)[0];
-	else return def.values[0];
+	if (typeName === "ZodLiteral") {
+		if ("_zod" in schema) return def.values?.[0];
+		else return def.value;
+	}
+	if (typeName === "ZodEnum") {
+		if ("_zod" in schema) return Object.values(def.entries)[0];
+		else return def.values[0];
+	}
 	if (typeName === "ZodNativeEnum") return Object.values(def.values)[0];
-	if (typeName === "ZodArray") if ("_zod" in schema) return [generateValidDataFromSchema(def.element, fieldName)];
-	else return [generateValidDataFromSchema(def.type, fieldName)];
+	if (typeName === "ZodArray") {
+		if ("_zod" in schema) return [generateValidDataFromSchema(def.element, fieldName)];
+		else return [generateValidDataFromSchema(def.type, fieldName)];
+	}
 	if (typeName === "ZodObject") {
 		const shape = typeof def.shape === "function" ? def.shape() : def.shape;
 		const obj = {};
@@ -309,6 +321,7 @@ function getDefaultValidPathParams(route) {
 	if (route.path.includes(":controllerId")) params.controllerId = "test-controller";
 	if (route.path.includes(":responseId")) params.responseId = "test-response";
 	if (route.path.includes(":resourceId")) params.resourceId = "test-resource";
+	if (route.path.includes(":sessionId")) params.sessionId = "test-session";
 	if (route.path.includes(":modelConfigId")) params.modelConfigId = "id1";
 	if (route.path.includes(":scorerId") && route.path.includes("/stored/scorers/")) params.scorerId = "test-stored-scorer";
 	else if (route.path.includes(":scorerId")) params.scorerId = "test-scorer";
@@ -333,6 +346,7 @@ function getDefaultValidPathParams(route) {
 	if (route.path.includes(":id") && route.path.includes("/mcp/v0/servers/")) params.id = "test-server-1";
 	if (route.path.includes(":serverId")) params.serverId = "test-server-1";
 	if (route.path.includes(":toolId") && route.path.includes("/mcp/")) params.toolId = "getWeather";
+	if (route.path.includes(":eventName")) params.eventName = "ticket.created";
 	if (route.path.includes(":workspaceId")) params.workspaceId = "test-workspace";
 	if (route.path.includes(":skillName")) params.skillName = "test-skill";
 	if (route.path.includes(":referencePath")) params.referencePath = "test-reference.md";
@@ -432,7 +446,8 @@ function createRouteTestSuite(config) {
 		});
 	});
 	routes.forEach((route) => {
-		describe(`${route.method} ${route.path}`, () => {
+		const routeKey = `${route.method} ${route.path}`;
+		describe(routeKey, () => {
 			if (route.deprecated) {
 				it("should be marked as deprecated", () => {
 					expect(route.deprecated).toBe(true);
@@ -784,9 +799,7 @@ async function createDefaultTestContext() {
 				case "multiply":
 					result = a * b;
 					break;
-				case "divide":
-					result = b !== 0 ? a / b : Infinity;
-					break;
+				case "divide": result = b !== 0 ? a / b : Infinity;
 			}
 			return { result };
 		}
@@ -811,7 +824,11 @@ async function createDefaultTestContext() {
 		appResources: { "ui://test/app": {
 			name: "Test App",
 			html: "<html><body>Test</body></html>"
-		} }
+		} },
+		events: { "ticket.created": defineEvent({
+			description: "A ticket was created",
+			payloadSchema: z$3.object({ id: z$3.string() })
+		}) }
 	});
 	const mcpServer2 = new MCPServer({
 		name: "Test Server 2",
@@ -956,7 +973,8 @@ async function createDefaultTestContext() {
 				"trace-aggregate",
 				"thread-query",
 				"thread-query-rows",
-				"span-query"
+				"span-query",
+				"span-aggregate"
 			]);
 			vi.spyOn(observability, "queryTraces").mockResolvedValue({
 				traces: [],
@@ -982,6 +1000,10 @@ async function createDefaultTestContext() {
 				spans: [],
 				page: { next: null }
 			});
+			vi.spyOn(observability, "aggregateSpans").mockResolvedValue({
+				rows: [],
+				truncated: false
+			});
 			await observability.createSpan({ span: {
 				spanId: "test-span",
 				traceId: "test-trace",
@@ -1338,9 +1360,10 @@ Follow these instructions for the test skill.
 		installedAt: (/* @__PURE__ */ new Date("2024-01-01T00:00:00.000Z")).toISOString()
 	};
 	fs.writeFileSync(path.join(agentSkillsDir, ".meta.json"), JSON.stringify(metaJson, null, 2));
+	const filesystem = new LocalFilesystem({ basePath: tempDir });
 	const workspace = new Workspace({
 		id: "test-workspace",
-		filesystem: new LocalFilesystem({ basePath: tempDir }),
+		filesystem,
 		skills: ["skills"],
 		bm25: true
 	});
@@ -1364,7 +1387,8 @@ function createTestTool(overrides = {}) {
 * Following the pattern from handler tests - uses actual MockMemory implementation
 */
 function createMockMemory() {
-	const mockMemory = new MockMemory({ storage: new InMemoryStore() });
+	const storage = new InMemoryStore();
+	const mockMemory = new MockMemory({ storage });
 	mockMemory.__registerMastra = vi.fn();
 	return mockMemory;
 }
@@ -1833,7 +1857,8 @@ function createRouteAdapterTestSuite(config) {
 			expect(response.status).toBe(200);
 			const data = response.data;
 			expect(data.filter).toEqual({ status: "active" });
-			expect(Array.isArray(data.tag) ? data.tag : [data.tag]).toContain("b");
+			const tags = Array.isArray(data.tag) ? data.tag : [data.tag];
+			expect(tags).toContain("b");
 			expect(data.keys).not.toContain("__proto__");
 			expect(data.keys).not.toContain("constructor");
 			expect(data.keys).not.toContain("prototype");
@@ -2104,7 +2129,8 @@ function createRouteAdapterTestSuite(config) {
 		Object.entries(deprecatedByCategory).forEach(([category, routes]) => {
 			describe(category, () => {
 				routes.forEach((route) => {
-					describe(`${route.method} ${route.path}`, () => {
+					const testName = `${route.method} ${route.path}`;
+					describe(testName, () => {
 						it("should be marked as deprecated", () => {
 							expect(route.deprecated).toBe(true);
 							expect(route.openapi?.deprecated).toBe(true);
@@ -2143,6 +2169,7 @@ function createRouteAdapterTestSuite(config) {
 			"/editor/builder/registries/:registryId/install",
 			"/background-tasks/stream",
 			"/agents/:agentId/observe",
+			"/mcp/:serverId/events/:eventName/stream",
 			"/agents/:agentId/recover",
 			"/agents/:agentId/plans/file",
 			"/tool-providers/:providerId/connections/:connectionId",
@@ -2155,7 +2182,9 @@ function createRouteAdapterTestSuite(config) {
 		];
 		const excludedPrefixes = ["/datasets", "/agent-controller"];
 		const isExcluded = (r) => r.deprecated || r.responseType === "mcp-http" || r.responseType === "mcp-sse" || authRoutesRequiringProviders.includes(r.path) || routesRequiringExternalDeps.includes(r.path) || excludedPrefixes.some((prefix) => r.path.startsWith(prefix));
-		const routesByCategory = SERVER_ROUTES.filter((r) => !isExcluded(r)).reduce((acc, route) => {
+		const activeRoutes = SERVER_ROUTES.filter((r) => !isExcluded(r));
+		const devOnlyRoutes = ["/mcp/:serverId/events/:eventName/emit"];
+		const routesByCategory = activeRoutes.reduce((acc, route) => {
 			const category = route.path.split("/")[1] || "root";
 			if (!acc[category]) acc[category] = [];
 			acc[category].push(route);
@@ -2164,7 +2193,16 @@ function createRouteAdapterTestSuite(config) {
 		Object.entries(routesByCategory).forEach(([category, routes]) => {
 			describe(category, () => {
 				routes.forEach((route) => {
-					describe(`${route.method} ${route.path}`, () => {
+					const testName = `${route.method} ${route.path}`;
+					describe(testName, () => {
+						if (devOnlyRoutes.includes(route.path)) {
+							beforeEach(() => {
+								vi.stubEnv("MASTRA_DEV", "true");
+							});
+							afterEach(() => {
+								vi.unstubAllEnvs();
+							});
+						}
 						it("should execute with valid request", async () => {
 							const request = buildRouteRequest(route);
 							const httpRequest = {
@@ -2199,7 +2237,8 @@ function createRouteAdapterTestSuite(config) {
 								query: request.query,
 								body: request.body
 							};
-							expect((await executeHttpRequest(app, httpRequest)).status).toBe(404);
+							const response = await executeHttpRequest(app, httpRequest);
+							expect(response.status).toBe(404);
 						});
 						if (route.path.includes(":workflowId")) it("should return 404 when workflow not found", async () => {
 							const request = buildRouteRequest(route, { pathParams: { workflowId: "non-existent-workflow" } });
@@ -2209,7 +2248,8 @@ function createRouteAdapterTestSuite(config) {
 								query: request.query,
 								body: request.body
 							};
-							expect((await executeHttpRequest(app, httpRequest)).status).toBe(404);
+							const response = await executeHttpRequest(app, httpRequest);
+							expect(response.status).toBe(404);
 						});
 						if (route.path.includes(":backgroundTaskId")) it("should return 404 when background task not found", async () => {
 							const request = buildRouteRequest(route, { pathParams: { backgroundTaskId: "non-existent-background-task" } });
@@ -2219,7 +2259,8 @@ function createRouteAdapterTestSuite(config) {
 								query: request.query,
 								body: request.body
 							};
-							expect((await executeHttpRequest(app, httpRequest)).status).toBe(404);
+							const response = await executeHttpRequest(app, httpRequest);
+							expect(response.status).toBe(404);
 						});
 						if (route.path.includes(":serverId")) it("should return 404 when MCP server not found (via :serverId)", async () => {
 							const request = buildRouteRequest(route, { pathParams: { serverId: "non-existent-server" } });
@@ -2229,7 +2270,8 @@ function createRouteAdapterTestSuite(config) {
 								query: request.query,
 								body: request.body
 							};
-							expect((await executeHttpRequest(app, httpRequest)).status).toBe(404);
+							const response = await executeHttpRequest(app, httpRequest);
+							expect(response.status).toBe(404);
 						});
 						if (route.path.includes("/mcp/v0/servers/:id")) it("should return 404 when MCP server not found (via :id)", async () => {
 							const request = buildRouteRequest(route, { pathParams: { id: "non-existent-server" } });
@@ -2239,7 +2281,8 @@ function createRouteAdapterTestSuite(config) {
 								query: request.query,
 								body: request.body
 							};
-							expect((await executeHttpRequest(app, httpRequest)).status).toBe(404);
+							const response = await executeHttpRequest(app, httpRequest);
+							expect(response.status).toBe(404);
 						});
 						if (route.path.includes(":processorId")) it("should return 404 when processor not found", async () => {
 							const request = buildRouteRequest(route, { pathParams: { processorId: "non-existent-processor" } });
@@ -2249,7 +2292,8 @@ function createRouteAdapterTestSuite(config) {
 								query: request.query,
 								body: request.body
 							};
-							expect((await executeHttpRequest(app, httpRequest)).status).toBe(404);
+							const response = await executeHttpRequest(app, httpRequest);
+							expect(response.status).toBe(404);
 						});
 						if (route.responseType === "stream") it("should be consumable via stream reader", async () => {
 							const request = buildRouteRequest(route);
@@ -2264,9 +2308,13 @@ function createRouteAdapterTestSuite(config) {
 							expect(response.stream).toBeDefined();
 							if (typeof response.stream.getReader === "function") {
 								const reader = response.stream.getReader();
-								expect(await reader.read()).toBeDefined();
+								const firstChunk = await reader.read();
+								expect(firstChunk).toBeDefined();
 								reader.releaseLock();
-							} else if (typeof response.stream[Symbol.asyncIterator] === "function") expect(await response.stream[Symbol.asyncIterator]().next()).toBeDefined();
+							} else if (typeof response.stream[Symbol.asyncIterator] === "function") {
+								const firstChunk = await response.stream[Symbol.asyncIterator]().next();
+								expect(firstChunk).toBeDefined();
+							}
 						});
 						if (route.queryParamSchema || route.bodySchema) it("should return 400 when schema validation fails", async () => {
 							const request = buildRouteRequest(route);
@@ -2323,7 +2371,8 @@ function createRouteAdapterTestSuite(config) {
 									}
 								}
 							};
-							expect((await executeHttpRequest(app, httpRequest)).status).toBeLessThan(500);
+							const response = await executeHttpRequest(app, httpRequest);
+							expect(response.status).toBeLessThan(500);
 						});
 						const bodySchema = route.bodySchema;
 						if (["POST", "PUT"].includes(route.method) && bodySchema) it("should spread body fields to handler params", async () => {
@@ -2384,7 +2433,8 @@ function createRouteAdapterTestSuite(config) {
 					expect(response.type).toBe("json");
 					const errorData = response.data;
 					expect(errorData).toBeDefined();
-					expect(errorData.error !== void 0 || errorData.message !== void 0 || errorData.details !== void 0 || errorData.statusCode !== void 0).toBe(true);
+					const hasErrorField = errorData.error !== void 0 || errorData.message !== void 0 || errorData.details !== void 0 || errorData.statusCode !== void 0;
+					expect(hasErrorField).toBe(true);
 				});
 			});
 			SERVER_ROUTES.filter((r) => r.method === "POST" && r.bodySchema && !isExcluded(r)).forEach((route) => {
@@ -2412,6 +2462,83 @@ function createRouteAdapterTestSuite(config) {
 				});
 			});
 		});
+		describe("Studio-only RBAC", () => {
+			const rolePermissions = {
+				viewer: ["agents:read"],
+				member: ["agents:read", "tools:execute"]
+			};
+			const studioAuth = {
+				authenticateToken: async (token) => rolePermissions[token] ? {
+					id: `user_${token}`,
+					role: token
+				} : null,
+				authorize: async () => true
+			};
+			const studioRbac = {
+				getPermissions: async (user) => rolePermissions[user.role] ?? [],
+				getRoles: async (user) => [user.role]
+			};
+			async function setupStudioRbac(options) {
+				const ctx = await createDefaultTestContext();
+				const originalGetServer = ctx.mastra.getServer.bind(ctx.mastra);
+				const customRoute = registerApiRoute("/studio-rbac/custom", {
+					method: "GET",
+					requiresPermission: "tools:execute",
+					handler: async (c) => c.json({ ok: true })
+				});
+				ctx.mastra.getServer = () => ({
+					...originalGetServer(),
+					apiRoutes: [customRoute],
+					...options.withServerAuth ? { auth: studioAuth } : {}
+				});
+				ctx.mastra.getStudio = () => ({
+					auth: studioAuth,
+					rbac: studioRbac
+				});
+				ctx.customRouteAuthConfig = /* @__PURE__ */ new Map([["GET:/studio-rbac/custom", true]]);
+				const route = {
+					method: "GET",
+					path: "/test/studio-rbac",
+					responseType: "json",
+					requiresPermission: "tools:execute",
+					handler: async () => ({ ok: true })
+				};
+				const mutableServerRoutes = SERVER_ROUTES;
+				const originalLength = mutableServerRoutes.length;
+				mutableServerRoutes.push(route);
+				try {
+					return (await setupAdapter(ctx)).app;
+				} finally {
+					mutableServerRoutes.splice(originalLength);
+				}
+			}
+			const studioRequest = (path, role) => ({
+				method: "GET",
+				path,
+				headers: {
+					Authorization: `Bearer ${role}`,
+					"x-mastra-client-type": "studio"
+				}
+			});
+			describe.each([{
+				label: "studio auth only",
+				withServerAuth: false
+			}, {
+				label: "studio auth + server auth without server RBAC",
+				withServerAuth: true
+			}])("$label", ({ withServerAuth }) => {
+				it.each(["/api/test/studio-rbac", "/studio-rbac/custom"])("denies a studio user without the required permission on %s", async (path) => {
+					const studioApp = await setupStudioRbac({ withServerAuth });
+					const response = await executeHttpRequest(studioApp, studioRequest(path, "viewer"));
+					expect(response.status).toBe(403);
+				});
+				it.each(["/api/test/studio-rbac", "/studio-rbac/custom"])("allows a studio user with the required permission on %s", async (path) => {
+					const studioApp = await setupStudioRbac({ withServerAuth });
+					const response = await executeHttpRequest(studioApp, studioRequest(path, "member"));
+					expect(response.status).toBe(200);
+				});
+			});
+		});
 		describe("Custom HTTPException responses", () => {
 			async function setupCustomErrorRoutes() {
 				let handlerCalls = 0;
@@ -2448,6 +2575,49 @@ function createRouteAdapterTestSuite(config) {
 							handlerCalls++;
 							throw new HTTPException(404, { message: "Legacy fallback" });
 						}
+					},
+					{
+						method: "GET",
+						path: "/custom/http-error-failing-items",
+						responseType: "json",
+						handler: async () => {
+							handlerCalls++;
+							throw new HTTPException(400, {
+								message: "Existing items fail the new schema",
+								cause: { failingItems: [{
+									index: 0,
+									data: {},
+									field: "input"
+								}] }
+							});
+						}
+					},
+					{
+						method: "GET",
+						path: "/custom/http-error-unsafe-cause",
+						responseType: "json",
+						handler: async () => {
+							handlerCalls++;
+							throw new HTTPException(400, {
+								message: "Unsafe cause",
+								cause: {
+									secret: "do-not-leak",
+									failingItems: "not-an-array"
+								}
+							});
+						}
+					},
+					{
+						method: "GET",
+						path: "/custom/details-status-error",
+						responseType: "json",
+						handler: async () => {
+							handlerCalls++;
+							throw Object.assign(/* @__PURE__ */ new Error("Details status"), {
+								details: { status: 422 },
+								cause: { failingItems: [{ index: 0 }] }
+							});
+						}
 					}
 				];
 				const mutableServerRoutes = SERVER_ROUTES;
@@ -2499,6 +2669,261 @@ function createRouteAdapterTestSuite(config) {
 				expect(response.data).toEqual({ error: "Legacy fallback" });
 				expect(custom.getHandlerCalls()).toBe(1);
 			});
+			it("includes failingItems from the HTTPException cause in the JSON body", async () => {
+				const custom = await setupCustomErrorRoutes();
+				const response = await executeHttpRequest(custom.app, {
+					method: "GET",
+					path: "/api/custom/http-error-failing-items"
+				});
+				expect(response.status).toBe(400);
+				expect(response.data.error).toBe("Existing items fail the new schema");
+				expect(response.data.cause).toEqual({ failingItems: [{
+					index: 0,
+					data: {},
+					field: "input"
+				}] });
+			});
+			it("never forwards an arbitrary HTTPException cause", async () => {
+				const custom = await setupCustomErrorRoutes();
+				const response = await executeHttpRequest(custom.app, {
+					method: "GET",
+					path: "/api/custom/http-error-unsafe-cause"
+				});
+				expect(response.status).toBe(400);
+				expect(response.data.error).toBe("Unsafe cause");
+				expect(response.data).not.toHaveProperty("cause");
+				expect(JSON.stringify(response.data)).not.toContain("do-not-leak");
+			});
+			it("keeps details.status errors as a message-only body", async () => {
+				const custom = await setupCustomErrorRoutes();
+				const response = await executeHttpRequest(custom.app, {
+					method: "GET",
+					path: "/api/custom/details-status-error"
+				});
+				expect(response.status).toBe(422);
+				expect(response.data.error).toBe("Details status");
+				expect(response.data).not.toHaveProperty("cause");
+			});
+		});
+		describe("Dataset schema update rejected by existing items", () => {
+			it("returns the failing items so clients can report how many items fail", async () => {
+				const context = await createDefaultTestContext();
+				const dataset = await context.mastra.datasets.create({ name: "schema-update-parity" });
+				await dataset.addItem({ input: { prompt: "hello" } });
+				const setup = await setupAdapter(context);
+				const response = await executeHttpRequest(setup.app, {
+					method: "PATCH",
+					path: `/api/datasets/${dataset.id}`,
+					body: { inputSchema: {
+						type: "object",
+						properties: { question: { type: "string" } },
+						required: ["question"]
+					} }
+				});
+				expect(response.status).toBe(400);
+				const failingItems = response.data?.cause?.failingItems;
+				expect(Array.isArray(failingItems)).toBe(true);
+				expect(failingItems).toHaveLength(1);
+				expect(failingItems[0]).toMatchObject({
+					index: 0,
+					field: "input"
+				});
+			});
+		});
+		describe("HTTPException thrown from a registerApiRoute custom route", () => {
+			class ForeignHTTPException extends Error {
+				status;
+				constructor(status, options) {
+					super(options.message);
+					this.status = status;
+				}
+				res = void 0;
+				getResponse() {
+					return new Response(this.message, { status: this.status });
+				}
+			}
+			async function setupCustomRouteErrors() {
+				const ctx = await createDefaultTestContext();
+				const originalGetServer = ctx.mastra.getServer.bind(ctx.mastra);
+				const routes = [
+					registerApiRoute("/custom-errors/not-found", {
+						method: "GET",
+						handler: async () => {
+							throw new HTTPException(404, { message: "Widget not found" });
+						}
+					}),
+					registerApiRoute("/custom-errors/conflict", {
+						method: "POST",
+						handler: async () => {
+							throw new ForeignHTTPException(409, { message: "Widget already exists" });
+						}
+					}),
+					registerApiRoute("/custom-errors/custom-response", {
+						method: "GET",
+						handler: async () => {
+							throw new HTTPException(429, { res: new Response(JSON.stringify({ error: "Slow down" }), {
+								status: 429,
+								headers: {
+									"Content-Type": "application/json",
+									"Retry-After": "5"
+								}
+							}) });
+						}
+					}),
+					registerApiRoute("/custom-errors/unexpected", {
+						method: "GET",
+						handler: async () => {
+							throw new Error("db password=do-not-leak");
+						}
+					}),
+					registerApiRoute("/custom-errors/invalid-status", {
+						method: "GET",
+						handler: async () => {
+							throw new ForeignHTTPException(NaN, { message: "bad status do-not-leak" });
+						}
+					})
+				];
+				ctx.mastra.getServer = () => ({
+					...originalGetServer(),
+					apiRoutes: routes
+				});
+				return (await setupAdapter(ctx)).app;
+			}
+			async function bodyText(response) {
+				if (!response.stream) return typeof response.data === "string" ? response.data : JSON.stringify(response.data);
+				const decoder = new TextDecoder();
+				let text = "";
+				for await (const chunk of response.stream) text += typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
+				return text + decoder.decode();
+			}
+			it("keeps the status and message of a Mastra HTTPException", async () => {
+				const customApp = await setupCustomRouteErrors();
+				const response = await executeHttpRequest(customApp, {
+					method: "GET",
+					path: "/custom-errors/not-found"
+				});
+				expect(response.status).toBe(404);
+				expect(JSON.parse(await bodyText(response))).toEqual({ error: "Widget not found" });
+			});
+			it("keeps the status and message of an HTTPException from another hono install", async () => {
+				const customApp = await setupCustomRouteErrors();
+				const response = await executeHttpRequest(customApp, {
+					method: "POST",
+					path: "/custom-errors/conflict",
+					body: {}
+				});
+				expect(response.status).toBe(409);
+				expect(JSON.parse(await bodyText(response))).toEqual({ error: "Widget already exists" });
+			});
+			it("returns the HTTPException custom response with its headers", async () => {
+				const customApp = await setupCustomRouteErrors();
+				const response = await executeHttpRequest(customApp, {
+					method: "GET",
+					path: "/custom-errors/custom-response"
+				});
+				expect(response.status).toBe(429);
+				expect(response.headers["retry-after"]).toBe("5");
+				expect(JSON.parse(await bodyText(response))).toEqual({ error: "Slow down" });
+			});
+			it("still hides unexpected errors behind a generic 500", async () => {
+				const customApp = await setupCustomRouteErrors();
+				const response = await executeHttpRequest(customApp, {
+					method: "GET",
+					path: "/custom-errors/unexpected"
+				});
+				expect(response.status).toBe(500);
+				const text = await bodyText(response);
+				expect(text).toContain("Internal Server Error");
+				expect(text).not.toContain("do-not-leak");
+			});
+			it("treats an HTTPException with a non-integer status as unexpected", async () => {
+				const customApp = await setupCustomRouteErrors();
+				const response = await executeHttpRequest(customApp, {
+					method: "GET",
+					path: "/custom-errors/invalid-status"
+				});
+				expect(response.status).toBe(500);
+				const text = await bodyText(response);
+				expect(text).toContain("Internal Server Error");
+				expect(text).not.toContain("do-not-leak");
+			});
+		});
+		describe("Dataset item rejected by the input schema", () => {
+			it("returns the failing field paths and messages without the submitted values", async () => {
+				const context = await createDefaultTestContext();
+				const dataset = await context.mastra.datasets.create({
+					name: "item-schema-parity",
+					inputSchema: {
+						type: "object",
+						properties: { question: { type: "string" } },
+						required: ["question"]
+					}
+				});
+				const setup = await setupAdapter(context);
+				const response = await executeHttpRequest(setup.app, {
+					method: "POST",
+					path: `/api/datasets/${dataset.id}/items`,
+					body: { input: {
+						question: { marker: "rejected-secret-value" },
+						note: "submitted-secret-value"
+					} }
+				});
+				expect(response.status).toBe(400);
+				const cause = response.data?.cause;
+				expect(cause?.field).toBe("input");
+				expect(cause?.errors).toEqual([{
+					path: "/question",
+					message: expect.any(String)
+				}]);
+				expect(JSON.stringify(response.data)).not.toContain("submitted-secret-value");
+				expect(JSON.stringify(response.data)).not.toContain("rejected-secret-value");
+			});
+			it("strips anything but path and message from validation errors", async () => {
+				const route = {
+					method: "GET",
+					path: "/custom/http-error-validation-cause",
+					responseType: "json",
+					handler: async () => {
+						throw new HTTPException(400, {
+							message: "Validation failed for input",
+							cause: {
+								field: "input",
+								errors: [{
+									path: "/question",
+									code: "invalid_type",
+									message: "Expected string",
+									received: "leak-me"
+								}],
+								rawInput: "leak-me-too"
+							}
+						});
+					}
+				};
+				const mutableServerRoutes = SERVER_ROUTES;
+				const originalLength = mutableServerRoutes.length;
+				mutableServerRoutes.push(route);
+				let app;
+				try {
+					app = (await setupAdapter(await createDefaultTestContext())).app;
+				} finally {
+					mutableServerRoutes.splice(originalLength);
+				}
+				const response = await executeHttpRequest(app, {
+					method: "GET",
+					path: "/api/custom/http-error-validation-cause"
+				});
+				expect(response.status).toBe(400);
+				expect(response.data).toEqual({
+					error: "Validation failed for input",
+					cause: {
+						field: "input",
+						errors: [{
+							path: "/question",
+							message: "Expected string"
+						}]
+					}
+				});
+			});
 		});
 		describe("Run claim conflict responses (#27638)", () => {
 			it.each([
@@ -2545,38 +2970,43 @@ function createRouteAdapterTestSuite(config) {
 		describe("Route Prefix", () => {
 			it("should register routes at prefixed paths without double /api", async () => {
 				const prefixedApp = (await setupAdapter(context, { prefix: "/v2" })).app;
-				expect((await executeHttpRequest(prefixedApp, {
+				const response = await executeHttpRequest(prefixedApp, {
 					method: "GET",
 					path: "/v2/agents"
-				})).status).toBeLessThan(400);
+				});
+				expect(response.status).toBeLessThan(400);
 			});
 			it("should not have routes at double /api path when prefix is set", async () => {
 				const prefixedApp = (await setupAdapter(context, { prefix: "/v2" })).app;
-				expect((await executeHttpRequest(prefixedApp, {
+				const response = await executeHttpRequest(prefixedApp, {
 					method: "GET",
 					path: "/v2/api/agents"
-				})).status).toBe(404);
+				});
+				expect(response.status).toBe(404);
 			});
 			it("should normalize prefix with trailing slash", async () => {
 				const prefixedApp = (await setupAdapter(context, { prefix: "/mastra/" })).app;
-				expect((await executeHttpRequest(prefixedApp, {
+				const response = await executeHttpRequest(prefixedApp, {
 					method: "GET",
 					path: "/mastra/agents"
-				})).status).toBeLessThan(400);
+				});
+				expect(response.status).toBeLessThan(400);
 			});
 			it("should normalize prefix without leading slash", async () => {
 				const prefixedApp = (await setupAdapter(context, { prefix: "mastra" })).app;
-				expect((await executeHttpRequest(prefixedApp, {
+				const response = await executeHttpRequest(prefixedApp, {
 					method: "GET",
 					path: "/mastra/agents"
-				})).status).toBeLessThan(400);
+				});
+				expect(response.status).toBeLessThan(400);
 			});
 			it("should not have routes at double-slash path when prefix has trailing slash", async () => {
 				const prefixedApp = (await setupAdapter(context, { prefix: "/mastra/" })).app;
-				expect((await executeHttpRequest(prefixedApp, {
+				const response = await executeHttpRequest(prefixedApp, {
 					method: "GET",
 					path: "/mastra//agents"
-				})).status).toBe(404);
+				});
+				expect(response.status).toBe(404);
 			});
 		});
 	});
@@ -2740,10 +3170,11 @@ function createMCPRouteTestSuite(config) {
 				expect(res.data.tools).toEqual(expect.arrayContaining([expect.objectContaining({ name: "getWeather" }), expect.objectContaining({ name: "calculate" })]));
 			});
 			it("should return 404 for non-existent server", async () => {
-				expect((await executeHttpRequest(app, {
+				const res = await executeHttpRequest(app, {
 					method: "GET",
 					path: "/api/mcp/non-existent/tools"
-				})).status).toBe(404);
+				});
+				expect(res.status).toBe(404);
 			});
 		});
 		describe("GET /api/mcp/:serverId/tools/:toolId", () => {
@@ -2760,10 +3191,11 @@ function createMCPRouteTestSuite(config) {
 				});
 			});
 			it("should return 404 for non-existent tool", async () => {
-				expect((await executeHttpRequest(app, {
+				const res = await executeHttpRequest(app, {
 					method: "GET",
 					path: `/api/mcp/${mcpServer1.id}/tools/non-existent`
-				})).status).toBe(404);
+				});
+				expect(res.status).toBe(404);
 			});
 		});
 		describe("POST /api/mcp/:serverId/tools/:toolId/execute", () => {
@@ -2793,7 +3225,7 @@ function createMCPRouteTestSuite(config) {
 				});
 			});
 			it("should return 404 for non-existent server", async () => {
-				expect((await executeHttpRequest(app, {
+				const res = await executeHttpRequest(app, {
 					method: "POST",
 					path: "/api/mcp/non-existent/tools/calculate/execute",
 					body: { data: {
@@ -2801,7 +3233,8 @@ function createMCPRouteTestSuite(config) {
 						a: 1,
 						b: 2
 					} }
-				})).status).toBe(404);
+				});
+				expect(res.status).toBe(404);
 			});
 			it("should return error for non-existent tool", async () => {
 				const res = await executeHttpRequest(app, {
@@ -3072,17 +3505,35 @@ function createMCPTransportTestSuite(config) {
 					case "multiply":
 						result = a * b;
 						break;
-					case "divide":
-						result = a / b;
-						break;
+					case "divide": result = a / b;
 				}
 				return { result };
 			}
 		});
+		const slowToolRuns = [];
+		const slowTool = createTool({
+			id: "slow",
+			description: "Waits until aborted, optionally streaming a log notification first",
+			inputSchema: z.object({ streamFirst: z.boolean() }),
+			execute: async ({ streamFirst }, context) => {
+				const signal = context?.abortSignal;
+				const run = {};
+				slowToolRuns.push(run);
+				signal?.addEventListener("abort", () => run.abortedAt = Date.now(), { once: true });
+				if (streamFirst) await context?.mcp?.log?.("info", "started");
+				await new Promise((resolve) => {
+					const timer = setTimeout(resolve, 5e3);
+					signal?.addEventListener("abort", () => (clearTimeout(timer), resolve()), { once: true });
+				});
+				run.finishedAt = Date.now();
+				return { aborted: !!signal?.aborted };
+			}
+		});
 		let httpServer;
 		let port;
 		let mcpServer1;
 		let mcpServer2;
+		let slowServer;
 		let mcpClient;
 		let mastra;
 		beforeAll(async () => {
@@ -3101,9 +3552,15 @@ function createMCPTransportTestSuite(config) {
 				description: "Test MCP Server 2",
 				tools: {}
 			});
+			slowServer = new MCPServer({
+				name: "slow-server",
+				version: "1.0.0",
+				tools: { slow: slowTool }
+			});
 			mastra = new Mastra$1({ mcpServers: {
 				"test-server-1": mcpServer1,
 				"test-server-2": mcpServer2,
+				"slow-server": slowServer,
 				"native-fixture": new NativeMCPFixture()
 			} });
 			const serverSetup = await createServer(mastra);
@@ -3119,6 +3576,7 @@ function createMCPTransportTestSuite(config) {
 			httpServer?.close();
 			await mcpServer1?.close();
 			await mcpServer2?.close();
+			await slowServer?.close();
 		}, 3e4);
 		describe("native MCP v2 adapter dispatch", () => {
 			it("dispatches HTTP through the shared adapter path", async () => {
@@ -3136,7 +3594,8 @@ function createMCPTransportTestSuite(config) {
 				path: "messages",
 				method: "POST"
 			}])("rejects the legacy $path route for a native server", async ({ path, method }) => {
-				expect((await fetch(`http://localhost:${port}/api/mcp/native-fixture/${path}`, { method })).status).toBe(404);
+				const response = await fetch(`http://localhost:${port}/api/mcp/native-fixture/${path}`, { method });
+				expect(response.status).toBe(404);
 			});
 			it("executes ordinary tools with the v2 request context and reports a suspended tool truthfully", async () => {
 				const base = `http://localhost:${port}/api/mcp/native-fixture/tools`;
@@ -3188,7 +3647,7 @@ function createMCPTransportTestSuite(config) {
 		describe("HTTP Transport (/api/mcp/:serverId/mcp)", () => {
 			describe("Error handling (raw HTTP)", () => {
 				it("should return 404 for non-existent server", async () => {
-					expect((await fetch(`http://localhost:${port}/api/mcp/non-existent/mcp`, {
+					const res = await fetch(`http://localhost:${port}/api/mcp/non-existent/mcp`, {
 						method: "POST",
 						headers: {
 							"Content-Type": "application/json",
@@ -3207,7 +3666,8 @@ function createMCPTransportTestSuite(config) {
 							},
 							id: 1
 						})
-					})).status).toBe(404);
+					});
+					expect(res.status).toBe(404);
 				});
 			});
 			describe("Protocol operations (MCPClient)", () => {
@@ -3243,7 +3703,8 @@ function createMCPTransportTestSuite(config) {
 					const tools = await mcpClient.listTools();
 					expect(tools["server1_getWeather"]).toBeDefined();
 					expect(tools["server1_calculate"]).toBeDefined();
-					expect(Object.keys(tools).filter((k) => k.startsWith("server2_"))).toHaveLength(0);
+					const server2Tools = Object.keys(tools).filter((k) => k.startsWith("server2_"));
+					expect(server2Tools).toHaveLength(0);
 				});
 			});
 			describe("Tool execution errors (MCPClient)", () => {
@@ -3252,17 +3713,18 @@ function createMCPTransportTestSuite(config) {
 				let failingMastra;
 				let failingHttpServer;
 				beforeAll(async () => {
+					const failingTool = createTool({
+						id: "failingTool",
+						description: "A tool that always throws an error",
+						inputSchema: z.object({}),
+						execute: async () => {
+							throw new Error("Tool execution failed intentionally");
+						}
+					});
 					failingServer = new MCPServer({
 						name: "failingServer",
 						version: "1.0.0",
-						tools: { failingTool: createTool({
-							id: "failingTool",
-							description: "A tool that always throws an error",
-							inputSchema: z.object({}),
-							execute: async () => {
-								throw new Error("Tool execution failed intentionally");
-							}
-						}) }
+						tools: { failingTool }
 					});
 					failingMastra = new Mastra$1({ mcpServers: { "failing-server": failingServer } });
 					const serverSetup = await createServer(failingMastra);
@@ -3294,13 +3756,73 @@ function createMCPTransportTestSuite(config) {
 				});
 			});
 		});
+		describe("HTTP Transport client disconnect", () => {
+			it.each([{
+				name: "before any response bytes are sent",
+				streamFirst: false
+			}, {
+				name: "after the response has started streaming",
+				streamFirst: true
+			}])("aborts the in-flight tool call when the client disconnects $name", async ({ streamFirst }) => {
+				const runsBefore = slowToolRuns.length;
+				const body = JSON.stringify({
+					jsonrpc: "2.0",
+					id: 1,
+					method: "tools/call",
+					params: {
+						name: "slow",
+						arguments: { streamFirst },
+						_meta: {
+							"io.modelcontextprotocol/protocolVersion": "2026-07-28",
+							"io.modelcontextprotocol/clientInfo": {
+								name: "disconnect-test",
+								version: "1.0.0"
+							},
+							"io.modelcontextprotocol/clientCapabilities": {},
+							"io.modelcontextprotocol/logLevel": "info"
+						}
+					}
+				});
+				let responseBytes = 0;
+				const req = http.request({
+					host: "localhost",
+					port,
+					method: "POST",
+					path: `/api/mcp/${slowServer.id}/mcp`,
+					headers: {
+						"content-type": "application/json",
+						accept: "application/json, text/event-stream",
+						"mcp-protocol-version": "2026-07-28",
+						"mcp-method": "tools/call",
+						"mcp-name": "slow",
+						"content-length": Buffer.byteLength(body)
+					}
+				});
+				req.on("response", (res) => {
+					res.on("data", (chunk) => responseBytes += chunk.length);
+					res.on("error", () => {});
+				});
+				req.on("error", () => {});
+				req.end(body);
+				await expect.poll(() => slowToolRuns.length, { timeout: 5e3 }).toBe(runsBefore + 1);
+				if (streamFirst) await expect.poll(() => responseBytes, { timeout: 5e3 }).toBeGreaterThan(0);
+				else expect(responseBytes).toBe(0);
+				const run = slowToolRuns[runsBefore];
+				const disconnectedAt = Date.now();
+				req.destroy();
+				await expect.poll(() => run.finishedAt, { timeout: 6e3 }).toBeDefined();
+				expect(run.abortedAt).toBeDefined();
+				expect(run.abortedAt - disconnectedAt).toBeLessThan(1e3);
+			}, 15e3);
+		});
 		describe("SSE Transport (/api/mcp/:serverId/sse)", () => {
 			describe("Error handling (raw HTTP)", () => {
 				it("should return 404 for non-existent server on GET /sse", async () => {
-					expect((await fetch(`http://localhost:${port}/api/mcp/non-existent/sse`)).status).toBe(404);
+					const res = await fetch(`http://localhost:${port}/api/mcp/non-existent/sse`);
+					expect(res.status).toBe(404);
 				});
 				it("should return 404 for non-existent server on POST /messages", async () => {
-					expect((await fetch(`http://localhost:${port}/api/mcp/non-existent/messages`, {
+					const res = await fetch(`http://localhost:${port}/api/mcp/non-existent/messages`, {
 						method: "POST",
 						headers: { "Content-Type": "application/json" },
 						body: JSON.stringify({
@@ -3308,14 +3830,16 @@ function createMCPTransportTestSuite(config) {
 							method: "test",
 							id: 1
 						})
-					})).status).toBe(404);
+					});
+					expect(res.status).toBe(404);
 				});
 			});
 			describe("MCP 2.x servers (MCPClient)", () => {
 				it("does not serve the legacy SSE transport for a 2.x MCPServer", async (ctx) => {
 					if (mcpServer1.mcpVersion !== 2) ctx.skip();
-					expect((await fetch(`http://localhost:${port}/api/mcp/${mcpServer1.id}/sse`)).status).toBe(404);
-					expect((await fetch(`http://localhost:${port}/api/mcp/${mcpServer1.id}/messages`, {
+					const res = await fetch(`http://localhost:${port}/api/mcp/${mcpServer1.id}/sse`);
+					expect(res.status).toBe(404);
+					const messages = await fetch(`http://localhost:${port}/api/mcp/${mcpServer1.id}/messages`, {
 						method: "POST",
 						headers: { "Content-Type": "application/json" },
 						body: JSON.stringify({
@@ -3323,7 +3847,8 @@ function createMCPTransportTestSuite(config) {
 							method: "tools/list",
 							id: 1
 						})
-					})).status).toBe(404);
+					});
+					expect(messages.status).toBe(404);
 				});
 				it("fails to connect through the SSE URL without downgrading", async (ctx) => {
 					if (mcpServer1.mcpVersion !== 2) ctx.skip();
@@ -3400,7 +3925,8 @@ function createMultipartTestSuite(config) {
 				body: formData
 			});
 			expect(response.status).toBe(200);
-			expect(await response.json()).toMatchObject({
+			const result = await response.json();
+			expect(result).toMatchObject({
 				success: true,
 				hasAudio: true
 			});
@@ -3435,10 +3961,11 @@ function createMultipartTestSuite(config) {
 				language: "en",
 				format: "mp3"
 			}));
-			expect((await fetch(`${serverInfo.baseUrl}/test/upload-with-options`, {
+			const response = await fetch(`${serverInfo.baseUrl}/test/upload-with-options`, {
 				method: "POST",
 				body: formData
-			})).status).toBe(200);
+			});
+			expect(response.status).toBe(200);
 			expect(receivedBody.options).toBeDefined();
 			expect(typeof receivedBody.options).toBe("object");
 			expect(receivedBody.options.language).toBe("en");
@@ -3468,10 +3995,11 @@ function createMultipartTestSuite(config) {
 			])], { type: "audio/wav" });
 			formData.append("audio", audioBlob, "test.wav");
 			formData.append("name", "test-recording");
-			expect((await fetch(`${serverInfo.baseUrl}/test/upload-with-string`, {
+			const response = await fetch(`${serverInfo.baseUrl}/test/upload-with-string`, {
 				method: "POST",
 				body: formData
-			})).status).toBe(200);
+			});
+			expect(response.status).toBe(200);
 			expect(receivedBody.name).toBe("test-recording");
 		});
 		it("should reject files exceeding size limit", async () => {
@@ -3493,10 +4021,11 @@ function createMultipartTestSuite(config) {
 			const formData = new FormData();
 			const largeBlob = new Blob([/* @__PURE__ */ new Uint8Array(200)], { type: "audio/wav" });
 			formData.append("audio", largeBlob, "large.wav");
-			expect((await fetch(`${serverInfo.baseUrl}/test/upload-limited`, {
+			const response = await fetch(`${serverInfo.baseUrl}/test/upload-limited`, {
 				method: "POST",
 				body: formData
-			})).status).toBeGreaterThanOrEqual(400);
+			});
+			expect(response.status).toBeGreaterThanOrEqual(400);
 		});
 		it("should handle empty FormData gracefully", async () => {
 			const { adapter, app } = await setupAdapter(context);
@@ -3529,7 +4058,8 @@ function createMultipartTestSuite(config) {
 				body: formData
 			});
 			expect(response.status).toBe(200);
-			expect(await response.json()).toMatchObject({
+			const result = await response.json();
+			expect(result).toMatchObject({
 				success: true,
 				bodyKeys: []
 			});
@@ -3571,7 +4101,8 @@ function createMultipartTestSuite(config) {
 				body: formData
 			});
 			expect(response.status).toBe(200);
-			expect(await response.json()).toMatchObject({
+			const result = await response.json();
+			expect(result).toMatchObject({
 				hasFile1: true,
 				hasFile2: true
 			});
@@ -3600,7 +4131,8 @@ function createMultipartTestSuite(config) {
 				body: JSON.stringify({ message: "Hello, World!" })
 			});
 			expect(response.status).toBe(200);
-			expect(await response.json()).toMatchObject({
+			const result = await response.json();
+			expect(result).toMatchObject({
 				success: true,
 				message: "Hello, World!"
 			});
@@ -3700,7 +4232,8 @@ function createHttpLoggingTestSuite(config) {
 			logSpy = vi.spyOn(adapter.logger, "info");
 			await adapter.init();
 			await addRoute(app, "GET", "/test", () => ({ message: "success" }));
-			expect((await executeRequest(app, "GET", "http://localhost/test")).status).toBe(200);
+			const response = await executeRequest(app, "GET", "http://localhost/test");
+			expect(response.status).toBe(200);
 			expect(logSpy).toHaveBeenCalledWith(expect.stringMatching(/GET \/test 200 \d+ms/), expect.objectContaining({
 				method: "GET",
 				path: "/test",
@@ -3860,7 +4393,7 @@ function createHttpLoggingTestSuite(config) {
 * request body for DELETE the same way it does for POST/PUT/PATCH.
 */
 function createBodyLimitTestSuite(config) {
-	const { suiteName = "Body Size Limit", maxSize = 100, createApp, setupAdapter, registerRoute, executeRequest, executeRequestWithoutContentLength, cleanupApp } = config;
+	const { suiteName = "Body Size Limit", maxSize = 100, createApp, setupAdapter, registerRoute, executeRequest, executeRequestWithoutContentLength, skipNonJsonStreamedBody, cleanupApp } = config;
 	describe(suiteName, () => {
 		const oversizedPayload = JSON.stringify({ padding: "x".repeat(maxSize * 4) });
 		it("enforces a route-specific limit without global body limit options", async () => {
@@ -3878,35 +4411,155 @@ function createBodyLimitTestSuite(config) {
 					return { receivedBody: body };
 				}
 			});
-			expect((await executeRequest(wiredApp, "POST", "http://localhost/test/route-body-limit", {
+			const response = await executeRequest(wiredApp, "POST", "http://localhost/test/route-body-limit", {
 				headers: { "Content-Type": "application/json" },
 				body: oversizedPayload
-			})).status).toBe(413);
-			expect(handlerCalled).toBe(false);
-			await cleanupApp?.(wiredApp);
-		});
-		if (executeRequestWithoutContentLength) it("rejects an oversized route body without Content-Length before handler execution", async () => {
-			const mastra = new Mastra$1({});
-			const app = createApp();
-			const { adapter, app: wiredApp } = await setupAdapter(app, mastra);
-			let handlerCalled = false;
-			await registerRoute(adapter, wiredApp, {
-				method: "POST",
-				path: "/test/route-body-limit-no-content-length",
-				responseType: "json",
-				maxBodySize: maxSize,
-				handler: async ({ body }) => {
-					handlerCalled = true;
-					return { receivedBody: body };
-				}
 			});
-			expect((await executeRequestWithoutContentLength(wiredApp, "POST", "http://localhost/test/route-body-limit-no-content-length", {
-				headers: { "Content-Type": "application/json" },
-				body: oversizedPayload
-			})).status).toBe(413);
+			expect(response.status).toBe(413);
 			expect(handlerCalled).toBe(false);
 			await cleanupApp?.(wiredApp);
 		});
+		if (executeRequestWithoutContentLength) {
+			it("rejects an oversized route body without Content-Length before handler execution", async () => {
+				const mastra = new Mastra$1({});
+				const app = createApp();
+				const { adapter, app: wiredApp } = await setupAdapter(app, mastra);
+				let handlerCalled = false;
+				await registerRoute(adapter, wiredApp, {
+					method: "POST",
+					path: "/test/route-body-limit-no-content-length",
+					responseType: "json",
+					maxBodySize: maxSize,
+					handler: async ({ body }) => {
+						handlerCalled = true;
+						return { receivedBody: body };
+					}
+				});
+				const response = await executeRequestWithoutContentLength(wiredApp, "POST", "http://localhost/test/route-body-limit-no-content-length", {
+					headers: { "Content-Type": "application/json" },
+					body: oversizedPayload
+				});
+				expect(response.status).toBe(413);
+				expect(handlerCalled).toBe(false);
+				await cleanupApp?.(wiredApp);
+			});
+			it.skipIf(skipNonJsonStreamedBody).each(["text/plain", "application/octet-stream"])("rejects an oversized %s body without Content-Length before handler execution", async (contentType) => {
+				const mastra = new Mastra$1({});
+				const app = createApp();
+				const { adapter, app: wiredApp } = await setupAdapter(app, mastra, {
+					maxSize,
+					onError: () => ({ error: "Request body too large" })
+				});
+				let handlerCalled = false;
+				await registerRoute(adapter, wiredApp, {
+					method: "POST",
+					path: "/test/body-limit-no-content-length-non-json",
+					responseType: "json",
+					handler: async () => {
+						handlerCalled = true;
+						return { ok: true };
+					}
+				});
+				const response = await executeRequestWithoutContentLength(wiredApp, "POST", "http://localhost/test/body-limit-no-content-length-non-json", {
+					headers: { "Content-Type": contentType },
+					body: "x".repeat(maxSize * 4)
+				});
+				expect(response.status).toBe(413);
+				expect(handlerCalled).toBe(false);
+				await cleanupApp?.(wiredApp);
+			});
+			const boundary = "bodylimitboundary";
+			const multipart = (parts) => parts.map((p) => `--${boundary}\r\nContent-Disposition: form-data; name="${p.name}"` + (p.filename ? `; filename="${p.filename}"\r\nContent-Type: application/octet-stream` : "") + `\r\n\r\n${p.value}\r\n`).join("") + `--${boundary}--\r\n`;
+			const multipartCases = {
+				"many small fields": multipart(Array.from({ length: 20 }, (_, i) => ({
+					name: `f${i}`,
+					value: "x".repeat(Math.floor(maxSize / 2))
+				}))),
+				"one oversized file": multipart([{
+					name: "file",
+					filename: "f.bin",
+					value: "x".repeat(maxSize * 4)
+				}])
+			};
+			it.each(Object.keys(multipartCases))("rejects an oversized multipart body (%s) without Content-Length before handler execution", async (caseName) => {
+				const mastra = new Mastra$1({});
+				const app = createApp();
+				const { adapter, app: wiredApp } = await setupAdapter(app, mastra, {
+					maxSize,
+					onError: () => ({ error: "Request body too large" })
+				});
+				let handlerCalled = false;
+				await registerRoute(adapter, wiredApp, {
+					method: "POST",
+					path: "/test/body-limit-no-content-length-multipart",
+					responseType: "json",
+					handler: async () => {
+						handlerCalled = true;
+						return { ok: true };
+					}
+				});
+				const response = await executeRequestWithoutContentLength(wiredApp, "POST", "http://localhost/test/body-limit-no-content-length-multipart", {
+					headers: { "Content-Type": `multipart/form-data; boundary=${boundary}` },
+					body: multipartCases[caseName]
+				});
+				expect(response.status).toBe(413);
+				expect(handlerCalled).toBe(false);
+				await cleanupApp?.(wiredApp);
+			});
+			it("passes a multipart body within the limit without Content-Length to the handler", async () => {
+				const mastra = new Mastra$1({});
+				const app = createApp();
+				const { adapter, app: wiredApp } = await setupAdapter(app, mastra, {
+					maxSize,
+					onError: () => ({ error: "Request body too large" })
+				});
+				let receivedBody;
+				await registerRoute(adapter, wiredApp, {
+					method: "POST",
+					path: "/test/body-limit-no-content-length-multipart-within",
+					responseType: "json",
+					handler: async ({ a }) => {
+						receivedBody = { a };
+						return { ok: true };
+					}
+				});
+				const response = await executeRequestWithoutContentLength(wiredApp, "POST", "http://localhost/test/body-limit-no-content-length-multipart-within", {
+					headers: { "Content-Type": `multipart/form-data; boundary=${boundary}` },
+					body: multipart([{
+						name: "a",
+						value: "ok"
+					}])
+				});
+				expect(response.status).toBe(200);
+				expect(receivedBody).toEqual({ a: "ok" });
+				await cleanupApp?.(wiredApp);
+			});
+			it("passes a JSON body within the limit without Content-Length to the handler", async () => {
+				const mastra = new Mastra$1({});
+				const app = createApp();
+				const { adapter, app: wiredApp } = await setupAdapter(app, mastra, {
+					maxSize,
+					onError: () => ({ error: "Request body too large" })
+				});
+				let receivedBody;
+				await registerRoute(adapter, wiredApp, {
+					method: "POST",
+					path: "/test/body-limit-no-content-length-within",
+					responseType: "json",
+					handler: async ({ message }) => {
+						receivedBody = { message };
+						return { ok: true };
+					}
+				});
+				const response = await executeRequestWithoutContentLength(wiredApp, "POST", "http://localhost/test/body-limit-no-content-length-within", {
+					headers: { "Content-Type": "application/json" },
+					body: JSON.stringify({ message: "hello" })
+				});
+				expect(response.status).toBe(200);
+				expect(receivedBody).toEqual({ message: "hello" });
+				await cleanupApp?.(wiredApp);
+			});
+		}
 		it.each(["POST", "DELETE"])("rejects an oversized %s body with 413", async (method) => {
 			const mastra = new Mastra$1({});
 			const app = createApp();
@@ -3920,15 +4573,107 @@ function createBodyLimitTestSuite(config) {
 				responseType: "json",
 				handler: async ({ body }) => ({ receivedBody: body })
 			});
-			expect((await executeRequest(wiredApp, method, "http://localhost/test/body-limit", {
+			const response = await executeRequest(wiredApp, method, "http://localhost/test/body-limit", {
 				headers: { "Content-Type": "application/json" },
 				body: oversizedPayload
-			})).status).toBe(413);
+			});
+			expect(response.status).toBe(413);
 			await cleanupApp?.(wiredApp);
 		});
 	});
 }
 //#endregion
-export { consumeSSEStream, createBodyLimitTestSuite, createDefaultTestContext, createHttpLoggingTestSuite, createMCPRouteTestSuite, createMCPTransportTestSuite, createMultipartTestSuite, createRouteAdapterTestSuite, createStreamWithSensitiveData, createStreamWithUnserializableChunk, expectSerializedStreamChunks };
+//#region src/custom-route-fga-test-suite.ts
+/**
+* Custom `registerApiRoute()` handlers read path params from the URL. FGA must
+* authorize that same resource, so a query or body field named like a path
+* param must not change which resource is checked.
+*/
+function createCustomRouteFGATestSuite(config) {
+	const { suiteName = "Custom route FGA", startServer } = config;
+	describe(suiteName, () => {
+		let close;
+		afterEach(async () => {
+			await close?.();
+			close = void 0;
+		});
+		const setup = async () => {
+			const check = vi.fn(async (_user, { resource }) => resource.id === "open");
+			const fga = {
+				check,
+				require: vi.fn(),
+				filterAccessible: vi.fn()
+			};
+			const routeFGA = {
+				resourceType: "doc",
+				resourceIdParam: "docId",
+				permission: "docs:read"
+			};
+			const handler = async (c) => c.json({ docId: c.req.param("docId") });
+			const mastra = new Mastra({
+				logger: false,
+				server: {
+					fga,
+					apiRoutes: [registerApiRoute("/docs/:docId", {
+						method: "GET",
+						fga: routeFGA,
+						handler
+					}), registerApiRoute("/docs/:docId", {
+						method: "POST",
+						fga: routeFGA,
+						handler
+					})]
+				}
+			});
+			const originalGetServer = mastra.getServer.bind(mastra);
+			mastra.getServer = () => ({
+				...originalGetServer(),
+				auth: {
+					authenticateToken: async (token) => token === "valid-token" ? { id: "user-1" } : null,
+					authorize: async () => true
+				}
+			});
+			const server = await startServer(mastra);
+			close = server.close;
+			const send = (path, init = {}) => server.request(path, {
+				...init,
+				headers: {
+					authorization: "Bearer valid-token",
+					...init.headers
+				}
+			});
+			return {
+				check,
+				send
+			};
+		};
+		const checkedIds = (check) => check.mock.calls.map(([, input]) => input.resource.id);
+		it("allows the permitted resource and denies the forbidden one", async () => {
+			const { send } = await setup();
+			const allowed = await send("/docs/open");
+			expect(allowed.status).toBe(200);
+			expect(await allowed.json()).toEqual({ docId: "open" });
+			expect((await send("/docs/locked")).status).toBe(403);
+		});
+		it("checks the path param when the query has a field with the same name", async () => {
+			const { check, send } = await setup();
+			const response = await send("/docs/locked?docId=open");
+			expect(response.status).toBe(403);
+			expect(checkedIds(check)).toEqual(["locked"]);
+		});
+		it("checks the path param when the JSON body has a field with the same name", async () => {
+			const { check, send } = await setup();
+			const response = await send("/docs/locked", {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({ docId: "open" })
+			});
+			expect(response.status).toBe(403);
+			expect(checkedIds(check)).toEqual(["locked"]);
+		});
+	});
+}
+//#endregion
+export { consumeSSEStream, createBodyLimitTestSuite, createCustomRouteFGATestSuite, createDefaultTestContext, createHttpLoggingTestSuite, createMCPRouteTestSuite, createMCPTransportTestSuite, createMultipartTestSuite, createRouteAdapterTestSuite, createStreamWithSensitiveData, createStreamWithUnserializableChunk, expectSerializedStreamChunks };
 
 //# sourceMappingURL=index.js.map