@mastra/server-adapters-test-suite 0.1.3 → 0.1.4-alpha.0

package/dist/index.js

@@ -1,4 +1,5 @@
 import { ErrorCategory, ErrorDomain, MastraError } from "@mastra/core/error";
+import { registerApiRoute } from "@mastra/core/server";
 import { handleError } from "@mastra/server/handlers/error";
 import { HTTPException, SERVER_ROUTES, WorkflowRegistry, createRoute } from "@mastra/server/server-adapter";
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
@@ -23,8 +24,9 @@ import { MastraVector } from "@mastra/core/vector";
 import { CompositeVoice } from "@mastra/core/voice";
 import { createStep, createWorkflow } from "@mastra/core/workflows";
 import { LocalFilesystem, Workspace } from "@mastra/core/workspace";
-import { MCPClient, MCPServer } from "@mastra/mcp";
+import { MCPClient, MCPServer, defineEvent } from "@mastra/mcp";
 import { Mastra as Mastra$1 } from "@mastra/core/mastra";
+import http from "http";
 import { MCPServerBase } from "@mastra/core/mcp";
 import { RequestContext } from "@mastra/core/request-context";
 import { standardSchemaToJSONSchema } from "@mastra/core/schema";
@@ -60,6 +62,7 @@ function getRouteSpecificSchemaDefaults(route) {
 		path: "entityName"
 	} };
 	if (route.path === "/agent-controller/:controllerId/sessions" && route.method === "POST") return { body: { resourceId: "test-resource" } };
+	if (route.path === "/mcp/:serverId/events/:eventName/emit") return { body: { data: { id: "test-ticket" } } };
 	if (route.path === "/datasets/:datasetId/compare") return { body: {
 		experimentIds: ["test-experiment-a", "test-experiment-b"],
 		baselineId: "test-experiment-a"
@@ -343,6 +346,7 @@ function getDefaultValidPathParams(route) {
 	if (route.path.includes(":id") && route.path.includes("/mcp/v0/servers/")) params.id = "test-server-1";
 	if (route.path.includes(":serverId")) params.serverId = "test-server-1";
 	if (route.path.includes(":toolId") && route.path.includes("/mcp/")) params.toolId = "getWeather";
+	if (route.path.includes(":eventName")) params.eventName = "ticket.created";
 	if (route.path.includes(":workspaceId")) params.workspaceId = "test-workspace";
 	if (route.path.includes(":skillName")) params.skillName = "test-skill";
 	if (route.path.includes(":referencePath")) params.referencePath = "test-reference.md";
@@ -820,7 +824,11 @@ async function createDefaultTestContext() {
 		appResources: { "ui://test/app": {
 			name: "Test App",
 			html: "<html><body>Test</body></html>"
-		} }
+		} },
+		events: { "ticket.created": defineEvent({
+			description: "A ticket was created",
+			payloadSchema: z$3.object({ id: z$3.string() })
+		}) }
 	});
 	const mcpServer2 = new MCPServer({
 		name: "Test Server 2",
@@ -965,7 +973,8 @@ async function createDefaultTestContext() {
 				"trace-aggregate",
 				"thread-query",
 				"thread-query-rows",
-				"span-query"
+				"span-query",
+				"span-aggregate"
 			]);
 			vi.spyOn(observability, "queryTraces").mockResolvedValue({
 				traces: [],
@@ -991,6 +1000,10 @@ async function createDefaultTestContext() {
 				spans: [],
 				page: { next: null }
 			});
+			vi.spyOn(observability, "aggregateSpans").mockResolvedValue({
+				rows: [],
+				truncated: false
+			});
 			await observability.createSpan({ span: {
 				spanId: "test-span",
 				traceId: "test-trace",
@@ -2156,6 +2169,7 @@ function createRouteAdapterTestSuite(config) {
 			"/editor/builder/registries/:registryId/install",
 			"/background-tasks/stream",
 			"/agents/:agentId/observe",
+			"/mcp/:serverId/events/:eventName/stream",
 			"/agents/:agentId/recover",
 			"/agents/:agentId/plans/file",
 			"/tool-providers/:providerId/connections/:connectionId",
@@ -2168,7 +2182,9 @@ function createRouteAdapterTestSuite(config) {
 		];
 		const excludedPrefixes = ["/datasets", "/agent-controller"];
 		const isExcluded = (r) => r.deprecated || r.responseType === "mcp-http" || r.responseType === "mcp-sse" || authRoutesRequiringProviders.includes(r.path) || routesRequiringExternalDeps.includes(r.path) || excludedPrefixes.some((prefix) => r.path.startsWith(prefix));
-		const routesByCategory = SERVER_ROUTES.filter((r) => !isExcluded(r)).reduce((acc, route) => {
+		const activeRoutes = SERVER_ROUTES.filter((r) => !isExcluded(r));
+		const devOnlyRoutes = ["/mcp/:serverId/events/:eventName/emit"];
+		const routesByCategory = activeRoutes.reduce((acc, route) => {
 			const category = route.path.split("/")[1] || "root";
 			if (!acc[category]) acc[category] = [];
 			acc[category].push(route);
@@ -2179,6 +2195,14 @@ function createRouteAdapterTestSuite(config) {
 				routes.forEach((route) => {
 					const testName = `${route.method} ${route.path}`;
 					describe(testName, () => {
+						if (devOnlyRoutes.includes(route.path)) {
+							beforeEach(() => {
+								vi.stubEnv("MASTRA_DEV", "true");
+							});
+							afterEach(() => {
+								vi.unstubAllEnvs();
+							});
+						}
 						it("should execute with valid request", async () => {
 							const request = buildRouteRequest(route);
 							const httpRequest = {
@@ -2438,6 +2462,83 @@ function createRouteAdapterTestSuite(config) {
 				});
 			});
 		});
+		describe("Studio-only RBAC", () => {
+			const rolePermissions = {
+				viewer: ["agents:read"],
+				member: ["agents:read", "tools:execute"]
+			};
+			const studioAuth = {
+				authenticateToken: async (token) => rolePermissions[token] ? {
+					id: `user_${token}`,
+					role: token
+				} : null,
+				authorize: async () => true
+			};
+			const studioRbac = {
+				getPermissions: async (user) => rolePermissions[user.role] ?? [],
+				getRoles: async (user) => [user.role]
+			};
+			async function setupStudioRbac(options) {
+				const ctx = await createDefaultTestContext();
+				const originalGetServer = ctx.mastra.getServer.bind(ctx.mastra);
+				const customRoute = registerApiRoute("/studio-rbac/custom", {
+					method: "GET",
+					requiresPermission: "tools:execute",
+					handler: async (c) => c.json({ ok: true })
+				});
+				ctx.mastra.getServer = () => ({
+					...originalGetServer(),
+					apiRoutes: [customRoute],
+					...options.withServerAuth ? { auth: studioAuth } : {}
+				});
+				ctx.mastra.getStudio = () => ({
+					auth: studioAuth,
+					rbac: studioRbac
+				});
+				ctx.customRouteAuthConfig = /* @__PURE__ */ new Map([["GET:/studio-rbac/custom", true]]);
+				const route = {
+					method: "GET",
+					path: "/test/studio-rbac",
+					responseType: "json",
+					requiresPermission: "tools:execute",
+					handler: async () => ({ ok: true })
+				};
+				const mutableServerRoutes = SERVER_ROUTES;
+				const originalLength = mutableServerRoutes.length;
+				mutableServerRoutes.push(route);
+				try {
+					return (await setupAdapter(ctx)).app;
+				} finally {
+					mutableServerRoutes.splice(originalLength);
+				}
+			}
+			const studioRequest = (path, role) => ({
+				method: "GET",
+				path,
+				headers: {
+					Authorization: `Bearer ${role}`,
+					"x-mastra-client-type": "studio"
+				}
+			});
+			describe.each([{
+				label: "studio auth only",
+				withServerAuth: false
+			}, {
+				label: "studio auth + server auth without server RBAC",
+				withServerAuth: true
+			}])("$label", ({ withServerAuth }) => {
+				it.each(["/api/test/studio-rbac", "/studio-rbac/custom"])("denies a studio user without the required permission on %s", async (path) => {
+					const studioApp = await setupStudioRbac({ withServerAuth });
+					const response = await executeHttpRequest(studioApp, studioRequest(path, "viewer"));
+					expect(response.status).toBe(403);
+				});
+				it.each(["/api/test/studio-rbac", "/studio-rbac/custom"])("allows a studio user with the required permission on %s", async (path) => {
+					const studioApp = await setupStudioRbac({ withServerAuth });
+					const response = await executeHttpRequest(studioApp, studioRequest(path, "member"));
+					expect(response.status).toBe(200);
+				});
+			});
+		});
 		describe("Custom HTTPException responses", () => {
 			async function setupCustomErrorRoutes() {
 				let handlerCalls = 0;
@@ -2474,6 +2575,49 @@ function createRouteAdapterTestSuite(config) {
 							handlerCalls++;
 							throw new HTTPException(404, { message: "Legacy fallback" });
 						}
+					},
+					{
+						method: "GET",
+						path: "/custom/http-error-failing-items",
+						responseType: "json",
+						handler: async () => {
+							handlerCalls++;
+							throw new HTTPException(400, {
+								message: "Existing items fail the new schema",
+								cause: { failingItems: [{
+									index: 0,
+									data: {},
+									field: "input"
+								}] }
+							});
+						}
+					},
+					{
+						method: "GET",
+						path: "/custom/http-error-unsafe-cause",
+						responseType: "json",
+						handler: async () => {
+							handlerCalls++;
+							throw new HTTPException(400, {
+								message: "Unsafe cause",
+								cause: {
+									secret: "do-not-leak",
+									failingItems: "not-an-array"
+								}
+							});
+						}
+					},
+					{
+						method: "GET",
+						path: "/custom/details-status-error",
+						responseType: "json",
+						handler: async () => {
+							handlerCalls++;
+							throw Object.assign(/* @__PURE__ */ new Error("Details status"), {
+								details: { status: 422 },
+								cause: { failingItems: [{ index: 0 }] }
+							});
+						}
 					}
 				];
 				const mutableServerRoutes = SERVER_ROUTES;
@@ -2525,6 +2669,261 @@ function createRouteAdapterTestSuite(config) {
 				expect(response.data).toEqual({ error: "Legacy fallback" });
 				expect(custom.getHandlerCalls()).toBe(1);
 			});
+			it("includes failingItems from the HTTPException cause in the JSON body", async () => {
+				const custom = await setupCustomErrorRoutes();
+				const response = await executeHttpRequest(custom.app, {
+					method: "GET",
+					path: "/api/custom/http-error-failing-items"
+				});
+				expect(response.status).toBe(400);
+				expect(response.data.error).toBe("Existing items fail the new schema");
+				expect(response.data.cause).toEqual({ failingItems: [{
+					index: 0,
+					data: {},
+					field: "input"
+				}] });
+			});
+			it("never forwards an arbitrary HTTPException cause", async () => {
+				const custom = await setupCustomErrorRoutes();
+				const response = await executeHttpRequest(custom.app, {
+					method: "GET",
+					path: "/api/custom/http-error-unsafe-cause"
+				});
+				expect(response.status).toBe(400);
+				expect(response.data.error).toBe("Unsafe cause");
+				expect(response.data).not.toHaveProperty("cause");
+				expect(JSON.stringify(response.data)).not.toContain("do-not-leak");
+			});
+			it("keeps details.status errors as a message-only body", async () => {
+				const custom = await setupCustomErrorRoutes();
+				const response = await executeHttpRequest(custom.app, {
+					method: "GET",
+					path: "/api/custom/details-status-error"
+				});
+				expect(response.status).toBe(422);
+				expect(response.data.error).toBe("Details status");
+				expect(response.data).not.toHaveProperty("cause");
+			});
+		});
+		describe("Dataset schema update rejected by existing items", () => {
+			it("returns the failing items so clients can report how many items fail", async () => {
+				const context = await createDefaultTestContext();
+				const dataset = await context.mastra.datasets.create({ name: "schema-update-parity" });
+				await dataset.addItem({ input: { prompt: "hello" } });
+				const setup = await setupAdapter(context);
+				const response = await executeHttpRequest(setup.app, {
+					method: "PATCH",
+					path: `/api/datasets/${dataset.id}`,
+					body: { inputSchema: {
+						type: "object",
+						properties: { question: { type: "string" } },
+						required: ["question"]
+					} }
+				});
+				expect(response.status).toBe(400);
+				const failingItems = response.data?.cause?.failingItems;
+				expect(Array.isArray(failingItems)).toBe(true);
+				expect(failingItems).toHaveLength(1);
+				expect(failingItems[0]).toMatchObject({
+					index: 0,
+					field: "input"
+				});
+			});
+		});
+		describe("HTTPException thrown from a registerApiRoute custom route", () => {
+			class ForeignHTTPException extends Error {
+				status;
+				constructor(status, options) {
+					super(options.message);
+					this.status = status;
+				}
+				res = void 0;
+				getResponse() {
+					return new Response(this.message, { status: this.status });
+				}
+			}
+			async function setupCustomRouteErrors() {
+				const ctx = await createDefaultTestContext();
+				const originalGetServer = ctx.mastra.getServer.bind(ctx.mastra);
+				const routes = [
+					registerApiRoute("/custom-errors/not-found", {
+						method: "GET",
+						handler: async () => {
+							throw new HTTPException(404, { message: "Widget not found" });
+						}
+					}),
+					registerApiRoute("/custom-errors/conflict", {
+						method: "POST",
+						handler: async () => {
+							throw new ForeignHTTPException(409, { message: "Widget already exists" });
+						}
+					}),
+					registerApiRoute("/custom-errors/custom-response", {
+						method: "GET",
+						handler: async () => {
+							throw new HTTPException(429, { res: new Response(JSON.stringify({ error: "Slow down" }), {
+								status: 429,
+								headers: {
+									"Content-Type": "application/json",
+									"Retry-After": "5"
+								}
+							}) });
+						}
+					}),
+					registerApiRoute("/custom-errors/unexpected", {
+						method: "GET",
+						handler: async () => {
+							throw new Error("db password=do-not-leak");
+						}
+					}),
+					registerApiRoute("/custom-errors/invalid-status", {
+						method: "GET",
+						handler: async () => {
+							throw new ForeignHTTPException(NaN, { message: "bad status do-not-leak" });
+						}
+					})
+				];
+				ctx.mastra.getServer = () => ({
+					...originalGetServer(),
+					apiRoutes: routes
+				});
+				return (await setupAdapter(ctx)).app;
+			}
+			async function bodyText(response) {
+				if (!response.stream) return typeof response.data === "string" ? response.data : JSON.stringify(response.data);
+				const decoder = new TextDecoder();
+				let text = "";
+				for await (const chunk of response.stream) text += typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
+				return text + decoder.decode();
+			}
+			it("keeps the status and message of a Mastra HTTPException", async () => {
+				const customApp = await setupCustomRouteErrors();
+				const response = await executeHttpRequest(customApp, {
+					method: "GET",
+					path: "/custom-errors/not-found"
+				});
+				expect(response.status).toBe(404);
+				expect(JSON.parse(await bodyText(response))).toEqual({ error: "Widget not found" });
+			});
+			it("keeps the status and message of an HTTPException from another hono install", async () => {
+				const customApp = await setupCustomRouteErrors();
+				const response = await executeHttpRequest(customApp, {
+					method: "POST",
+					path: "/custom-errors/conflict",
+					body: {}
+				});
+				expect(response.status).toBe(409);
+				expect(JSON.parse(await bodyText(response))).toEqual({ error: "Widget already exists" });
+			});
+			it("returns the HTTPException custom response with its headers", async () => {
+				const customApp = await setupCustomRouteErrors();
+				const response = await executeHttpRequest(customApp, {
+					method: "GET",
+					path: "/custom-errors/custom-response"
+				});
+				expect(response.status).toBe(429);
+				expect(response.headers["retry-after"]).toBe("5");
+				expect(JSON.parse(await bodyText(response))).toEqual({ error: "Slow down" });
+			});
+			it("still hides unexpected errors behind a generic 500", async () => {
+				const customApp = await setupCustomRouteErrors();
+				const response = await executeHttpRequest(customApp, {
+					method: "GET",
+					path: "/custom-errors/unexpected"
+				});
+				expect(response.status).toBe(500);
+				const text = await bodyText(response);
+				expect(text).toContain("Internal Server Error");
+				expect(text).not.toContain("do-not-leak");
+			});
+			it("treats an HTTPException with a non-integer status as unexpected", async () => {
+				const customApp = await setupCustomRouteErrors();
+				const response = await executeHttpRequest(customApp, {
+					method: "GET",
+					path: "/custom-errors/invalid-status"
+				});
+				expect(response.status).toBe(500);
+				const text = await bodyText(response);
+				expect(text).toContain("Internal Server Error");
+				expect(text).not.toContain("do-not-leak");
+			});
+		});
+		describe("Dataset item rejected by the input schema", () => {
+			it("returns the failing field paths and messages without the submitted values", async () => {
+				const context = await createDefaultTestContext();
+				const dataset = await context.mastra.datasets.create({
+					name: "item-schema-parity",
+					inputSchema: {
+						type: "object",
+						properties: { question: { type: "string" } },
+						required: ["question"]
+					}
+				});
+				const setup = await setupAdapter(context);
+				const response = await executeHttpRequest(setup.app, {
+					method: "POST",
+					path: `/api/datasets/${dataset.id}/items`,
+					body: { input: {
+						question: { marker: "rejected-secret-value" },
+						note: "submitted-secret-value"
+					} }
+				});
+				expect(response.status).toBe(400);
+				const cause = response.data?.cause;
+				expect(cause?.field).toBe("input");
+				expect(cause?.errors).toEqual([{
+					path: "/question",
+					message: expect.any(String)
+				}]);
+				expect(JSON.stringify(response.data)).not.toContain("submitted-secret-value");
+				expect(JSON.stringify(response.data)).not.toContain("rejected-secret-value");
+			});
+			it("strips anything but path and message from validation errors", async () => {
+				const route = {
+					method: "GET",
+					path: "/custom/http-error-validation-cause",
+					responseType: "json",
+					handler: async () => {
+						throw new HTTPException(400, {
+							message: "Validation failed for input",
+							cause: {
+								field: "input",
+								errors: [{
+									path: "/question",
+									code: "invalid_type",
+									message: "Expected string",
+									received: "leak-me"
+								}],
+								rawInput: "leak-me-too"
+							}
+						});
+					}
+				};
+				const mutableServerRoutes = SERVER_ROUTES;
+				const originalLength = mutableServerRoutes.length;
+				mutableServerRoutes.push(route);
+				let app;
+				try {
+					app = (await setupAdapter(await createDefaultTestContext())).app;
+				} finally {
+					mutableServerRoutes.splice(originalLength);
+				}
+				const response = await executeHttpRequest(app, {
+					method: "GET",
+					path: "/api/custom/http-error-validation-cause"
+				});
+				expect(response.status).toBe(400);
+				expect(response.data).toEqual({
+					error: "Validation failed for input",
+					cause: {
+						field: "input",
+						errors: [{
+							path: "/question",
+							message: "Expected string"
+						}]
+					}
+				});
+			});
 		});
 		describe("Run claim conflict responses (#27638)", () => {
 			it.each([
@@ -3111,10 +3510,30 @@ function createMCPTransportTestSuite(config) {
 				return { result };
 			}
 		});
+		const slowToolRuns = [];
+		const slowTool = createTool({
+			id: "slow",
+			description: "Waits until aborted, optionally streaming a log notification first",
+			inputSchema: z.object({ streamFirst: z.boolean() }),
+			execute: async ({ streamFirst }, context) => {
+				const signal = context?.abortSignal;
+				const run = {};
+				slowToolRuns.push(run);
+				signal?.addEventListener("abort", () => run.abortedAt = Date.now(), { once: true });
+				if (streamFirst) await context?.mcp?.log?.("info", "started");
+				await new Promise((resolve) => {
+					const timer = setTimeout(resolve, 5e3);
+					signal?.addEventListener("abort", () => (clearTimeout(timer), resolve()), { once: true });
+				});
+				run.finishedAt = Date.now();
+				return { aborted: !!signal?.aborted };
+			}
+		});
 		let httpServer;
 		let port;
 		let mcpServer1;
 		let mcpServer2;
+		let slowServer;
 		let mcpClient;
 		let mastra;
 		beforeAll(async () => {
@@ -3133,9 +3552,15 @@ function createMCPTransportTestSuite(config) {
 				description: "Test MCP Server 2",
 				tools: {}
 			});
+			slowServer = new MCPServer({
+				name: "slow-server",
+				version: "1.0.0",
+				tools: { slow: slowTool }
+			});
 			mastra = new Mastra$1({ mcpServers: {
 				"test-server-1": mcpServer1,
 				"test-server-2": mcpServer2,
+				"slow-server": slowServer,
 				"native-fixture": new NativeMCPFixture()
 			} });
 			const serverSetup = await createServer(mastra);
@@ -3151,6 +3576,7 @@ function createMCPTransportTestSuite(config) {
 			httpServer?.close();
 			await mcpServer1?.close();
 			await mcpServer2?.close();
+			await slowServer?.close();
 		}, 3e4);
 		describe("native MCP v2 adapter dispatch", () => {
 			it("dispatches HTTP through the shared adapter path", async () => {
@@ -3330,6 +3756,65 @@ function createMCPTransportTestSuite(config) {
 				});
 			});
 		});
+		describe("HTTP Transport client disconnect", () => {
+			it.each([{
+				name: "before any response bytes are sent",
+				streamFirst: false
+			}, {
+				name: "after the response has started streaming",
+				streamFirst: true
+			}])("aborts the in-flight tool call when the client disconnects $name", async ({ streamFirst }) => {
+				const runsBefore = slowToolRuns.length;
+				const body = JSON.stringify({
+					jsonrpc: "2.0",
+					id: 1,
+					method: "tools/call",
+					params: {
+						name: "slow",
+						arguments: { streamFirst },
+						_meta: {
+							"io.modelcontextprotocol/protocolVersion": "2026-07-28",
+							"io.modelcontextprotocol/clientInfo": {
+								name: "disconnect-test",
+								version: "1.0.0"
+							},
+							"io.modelcontextprotocol/clientCapabilities": {},
+							"io.modelcontextprotocol/logLevel": "info"
+						}
+					}
+				});
+				let responseBytes = 0;
+				const req = http.request({
+					host: "localhost",
+					port,
+					method: "POST",
+					path: `/api/mcp/${slowServer.id}/mcp`,
+					headers: {
+						"content-type": "application/json",
+						accept: "application/json, text/event-stream",
+						"mcp-protocol-version": "2026-07-28",
+						"mcp-method": "tools/call",
+						"mcp-name": "slow",
+						"content-length": Buffer.byteLength(body)
+					}
+				});
+				req.on("response", (res) => {
+					res.on("data", (chunk) => responseBytes += chunk.length);
+					res.on("error", () => {});
+				});
+				req.on("error", () => {});
+				req.end(body);
+				await expect.poll(() => slowToolRuns.length, { timeout: 5e3 }).toBe(runsBefore + 1);
+				if (streamFirst) await expect.poll(() => responseBytes, { timeout: 5e3 }).toBeGreaterThan(0);
+				else expect(responseBytes).toBe(0);
+				const run = slowToolRuns[runsBefore];
+				const disconnectedAt = Date.now();
+				req.destroy();
+				await expect.poll(() => run.finishedAt, { timeout: 6e3 }).toBeDefined();
+				expect(run.abortedAt).toBeDefined();
+				expect(run.abortedAt - disconnectedAt).toBeLessThan(1e3);
+			}, 15e3);
+		});
 		describe("SSE Transport (/api/mcp/:serverId/sse)", () => {
 			describe("Error handling (raw HTTP)", () => {
 				it("should return 404 for non-existent server on GET /sse", async () => {
@@ -3908,7 +4393,7 @@ function createHttpLoggingTestSuite(config) {
 * request body for DELETE the same way it does for POST/PUT/PATCH.
 */
 function createBodyLimitTestSuite(config) {
-	const { suiteName = "Body Size Limit", maxSize = 100, createApp, setupAdapter, registerRoute, executeRequest, executeRequestWithoutContentLength, cleanupApp } = config;
+	const { suiteName = "Body Size Limit", maxSize = 100, createApp, setupAdapter, registerRoute, executeRequest, executeRequestWithoutContentLength, skipNonJsonStreamedBody, cleanupApp } = config;
 	describe(suiteName, () => {
 		const oversizedPayload = JSON.stringify({ padding: "x".repeat(maxSize * 4) });
 		it("enforces a route-specific limit without global body limit options", async () => {
@@ -3934,29 +4419,147 @@ function createBodyLimitTestSuite(config) {
 			expect(handlerCalled).toBe(false);
 			await cleanupApp?.(wiredApp);
 		});
-		if (executeRequestWithoutContentLength) it("rejects an oversized route body without Content-Length before handler execution", async () => {
-			const mastra = new Mastra$1({});
-			const app = createApp();
-			const { adapter, app: wiredApp } = await setupAdapter(app, mastra);
-			let handlerCalled = false;
-			await registerRoute(adapter, wiredApp, {
-				method: "POST",
-				path: "/test/route-body-limit-no-content-length",
-				responseType: "json",
-				maxBodySize: maxSize,
-				handler: async ({ body }) => {
-					handlerCalled = true;
-					return { receivedBody: body };
-				}
+		if (executeRequestWithoutContentLength) {
+			it("rejects an oversized route body without Content-Length before handler execution", async () => {
+				const mastra = new Mastra$1({});
+				const app = createApp();
+				const { adapter, app: wiredApp } = await setupAdapter(app, mastra);
+				let handlerCalled = false;
+				await registerRoute(adapter, wiredApp, {
+					method: "POST",
+					path: "/test/route-body-limit-no-content-length",
+					responseType: "json",
+					maxBodySize: maxSize,
+					handler: async ({ body }) => {
+						handlerCalled = true;
+						return { receivedBody: body };
+					}
+				});
+				const response = await executeRequestWithoutContentLength(wiredApp, "POST", "http://localhost/test/route-body-limit-no-content-length", {
+					headers: { "Content-Type": "application/json" },
+					body: oversizedPayload
+				});
+				expect(response.status).toBe(413);
+				expect(handlerCalled).toBe(false);
+				await cleanupApp?.(wiredApp);
 			});
-			const response = await executeRequestWithoutContentLength(wiredApp, "POST", "http://localhost/test/route-body-limit-no-content-length", {
-				headers: { "Content-Type": "application/json" },
-				body: oversizedPayload
+			it.skipIf(skipNonJsonStreamedBody).each(["text/plain", "application/octet-stream"])("rejects an oversized %s body without Content-Length before handler execution", async (contentType) => {
+				const mastra = new Mastra$1({});
+				const app = createApp();
+				const { adapter, app: wiredApp } = await setupAdapter(app, mastra, {
+					maxSize,
+					onError: () => ({ error: "Request body too large" })
+				});
+				let handlerCalled = false;
+				await registerRoute(adapter, wiredApp, {
+					method: "POST",
+					path: "/test/body-limit-no-content-length-non-json",
+					responseType: "json",
+					handler: async () => {
+						handlerCalled = true;
+						return { ok: true };
+					}
+				});
+				const response = await executeRequestWithoutContentLength(wiredApp, "POST", "http://localhost/test/body-limit-no-content-length-non-json", {
+					headers: { "Content-Type": contentType },
+					body: "x".repeat(maxSize * 4)
+				});
+				expect(response.status).toBe(413);
+				expect(handlerCalled).toBe(false);
+				await cleanupApp?.(wiredApp);
 			});
-			expect(response.status).toBe(413);
-			expect(handlerCalled).toBe(false);
-			await cleanupApp?.(wiredApp);
-		});
+			const boundary = "bodylimitboundary";
+			const multipart = (parts) => parts.map((p) => `--${boundary}\r\nContent-Disposition: form-data; name="${p.name}"` + (p.filename ? `; filename="${p.filename}"\r\nContent-Type: application/octet-stream` : "") + `\r\n\r\n${p.value}\r\n`).join("") + `--${boundary}--\r\n`;
+			const multipartCases = {
+				"many small fields": multipart(Array.from({ length: 20 }, (_, i) => ({
+					name: `f${i}`,
+					value: "x".repeat(Math.floor(maxSize / 2))
+				}))),
+				"one oversized file": multipart([{
+					name: "file",
+					filename: "f.bin",
+					value: "x".repeat(maxSize * 4)
+				}])
+			};
+			it.each(Object.keys(multipartCases))("rejects an oversized multipart body (%s) without Content-Length before handler execution", async (caseName) => {
+				const mastra = new Mastra$1({});
+				const app = createApp();
+				const { adapter, app: wiredApp } = await setupAdapter(app, mastra, {
+					maxSize,
+					onError: () => ({ error: "Request body too large" })
+				});
+				let handlerCalled = false;
+				await registerRoute(adapter, wiredApp, {
+					method: "POST",
+					path: "/test/body-limit-no-content-length-multipart",
+					responseType: "json",
+					handler: async () => {
+						handlerCalled = true;
+						return { ok: true };
+					}
+				});
+				const response = await executeRequestWithoutContentLength(wiredApp, "POST", "http://localhost/test/body-limit-no-content-length-multipart", {
+					headers: { "Content-Type": `multipart/form-data; boundary=${boundary}` },
+					body: multipartCases[caseName]
+				});
+				expect(response.status).toBe(413);
+				expect(handlerCalled).toBe(false);
+				await cleanupApp?.(wiredApp);
+			});
+			it("passes a multipart body within the limit without Content-Length to the handler", async () => {
+				const mastra = new Mastra$1({});
+				const app = createApp();
+				const { adapter, app: wiredApp } = await setupAdapter(app, mastra, {
+					maxSize,
+					onError: () => ({ error: "Request body too large" })
+				});
+				let receivedBody;
+				await registerRoute(adapter, wiredApp, {
+					method: "POST",
+					path: "/test/body-limit-no-content-length-multipart-within",
+					responseType: "json",
+					handler: async ({ a }) => {
+						receivedBody = { a };
+						return { ok: true };
+					}
+				});
+				const response = await executeRequestWithoutContentLength(wiredApp, "POST", "http://localhost/test/body-limit-no-content-length-multipart-within", {
+					headers: { "Content-Type": `multipart/form-data; boundary=${boundary}` },
+					body: multipart([{
+						name: "a",
+						value: "ok"
+					}])
+				});
+				expect(response.status).toBe(200);
+				expect(receivedBody).toEqual({ a: "ok" });
+				await cleanupApp?.(wiredApp);
+			});
+			it("passes a JSON body within the limit without Content-Length to the handler", async () => {
+				const mastra = new Mastra$1({});
+				const app = createApp();
+				const { adapter, app: wiredApp } = await setupAdapter(app, mastra, {
+					maxSize,
+					onError: () => ({ error: "Request body too large" })
+				});
+				let receivedBody;
+				await registerRoute(adapter, wiredApp, {
+					method: "POST",
+					path: "/test/body-limit-no-content-length-within",
+					responseType: "json",
+					handler: async ({ message }) => {
+						receivedBody = { message };
+						return { ok: true };
+					}
+				});
+				const response = await executeRequestWithoutContentLength(wiredApp, "POST", "http://localhost/test/body-limit-no-content-length-within", {
+					headers: { "Content-Type": "application/json" },
+					body: JSON.stringify({ message: "hello" })
+				});
+				expect(response.status).toBe(200);
+				expect(receivedBody).toEqual({ message: "hello" });
+				await cleanupApp?.(wiredApp);
+			});
+		}
 		it.each(["POST", "DELETE"])("rejects an oversized %s body with 413", async (method) => {
 			const mastra = new Mastra$1({});
 			const app = createApp();
@@ -3980,6 +4583,97 @@ function createBodyLimitTestSuite(config) {
 	});
 }
 //#endregion
-export { consumeSSEStream, createBodyLimitTestSuite, createDefaultTestContext, createHttpLoggingTestSuite, createMCPRouteTestSuite, createMCPTransportTestSuite, createMultipartTestSuite, createRouteAdapterTestSuite, createStreamWithSensitiveData, createStreamWithUnserializableChunk, expectSerializedStreamChunks };
+//#region src/custom-route-fga-test-suite.ts
+/**
+* Custom `registerApiRoute()` handlers read path params from the URL. FGA must
+* authorize that same resource, so a query or body field named like a path
+* param must not change which resource is checked.
+*/
+function createCustomRouteFGATestSuite(config) {
+	const { suiteName = "Custom route FGA", startServer } = config;
+	describe(suiteName, () => {
+		let close;
+		afterEach(async () => {
+			await close?.();
+			close = void 0;
+		});
+		const setup = async () => {
+			const check = vi.fn(async (_user, { resource }) => resource.id === "open");
+			const fga = {
+				check,
+				require: vi.fn(),
+				filterAccessible: vi.fn()
+			};
+			const routeFGA = {
+				resourceType: "doc",
+				resourceIdParam: "docId",
+				permission: "docs:read"
+			};
+			const handler = async (c) => c.json({ docId: c.req.param("docId") });
+			const mastra = new Mastra({
+				logger: false,
+				server: {
+					fga,
+					apiRoutes: [registerApiRoute("/docs/:docId", {
+						method: "GET",
+						fga: routeFGA,
+						handler
+					}), registerApiRoute("/docs/:docId", {
+						method: "POST",
+						fga: routeFGA,
+						handler
+					})]
+				}
+			});
+			const originalGetServer = mastra.getServer.bind(mastra);
+			mastra.getServer = () => ({
+				...originalGetServer(),
+				auth: {
+					authenticateToken: async (token) => token === "valid-token" ? { id: "user-1" } : null,
+					authorize: async () => true
+				}
+			});
+			const server = await startServer(mastra);
+			close = server.close;
+			const send = (path, init = {}) => server.request(path, {
+				...init,
+				headers: {
+					authorization: "Bearer valid-token",
+					...init.headers
+				}
+			});
+			return {
+				check,
+				send
+			};
+		};
+		const checkedIds = (check) => check.mock.calls.map(([, input]) => input.resource.id);
+		it("allows the permitted resource and denies the forbidden one", async () => {
+			const { send } = await setup();
+			const allowed = await send("/docs/open");
+			expect(allowed.status).toBe(200);
+			expect(await allowed.json()).toEqual({ docId: "open" });
+			expect((await send("/docs/locked")).status).toBe(403);
+		});
+		it("checks the path param when the query has a field with the same name", async () => {
+			const { check, send } = await setup();
+			const response = await send("/docs/locked?docId=open");
+			expect(response.status).toBe(403);
+			expect(checkedIds(check)).toEqual(["locked"]);
+		});
+		it("checks the path param when the JSON body has a field with the same name", async () => {
+			const { check, send } = await setup();
+			const response = await send("/docs/locked", {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({ docId: "open" })
+			});
+			expect(response.status).toBe(403);
+			expect(checkedIds(check)).toEqual(["locked"]);
+		});
+	});
+}
+//#endregion
+export { consumeSSEStream, createBodyLimitTestSuite, createCustomRouteFGATestSuite, createDefaultTestContext, createHttpLoggingTestSuite, createMCPRouteTestSuite, createMCPTransportTestSuite, createMultipartTestSuite, createRouteAdapterTestSuite, createStreamWithSensitiveData, createStreamWithUnserializableChunk, expectSerializedStreamChunks };
 
 //# sourceMappingURL=index.js.map