@mastra/server 1.65.0-alpha.1 → 1.65.0-alpha.11

package/dist/server/handlers/auth.cjs

@@ -4,7 +4,7 @@ const require_http_exception = require("../../http-exception-CKDHupKw.cjs");
 const require_route_builder = require("../../route-builder-C8n4ugUf.cjs");
 const require_constants = require("../../constants-4IJp_uzj.cjs");
 const require_server_handlers_error = require("./error.cjs");
-const require_helpers = require("../../helpers-BWxRRShz.cjs");
+const require_helpers = require("../../helpers-8jl_xtug.cjs");
 const require_auth = require("../../auth-B8fQdEg-.cjs");
 let zod_v4 = require("zod/v4");
 //#region src/server/handlers/auth.ts

package/dist/server/handlers/auth.js

@@ -2,7 +2,7 @@ import { t as HTTPException } from "../../http-exception-CyfxZB6W.js";
 import { n as createRoute, t as createPublicRoute } from "../../route-builder-BveLN9LU.js";
 import { a as MASTRA_PUBLIC_HOST_HEADER, m as isStudioClientTypeHeader } from "../../constants-0jFCWoex.js";
 import { handleError } from "./error.js";
-import { p as supportsSessionRefresh } from "../../helpers-DBAYsA50.js";
+import { p as supportsSessionRefresh } from "../../helpers-610L0lwQ.js";
 import { _ as ssoLoginQuerySchema, c as currentUserResponseSchema, d as permissionPatternsResponseSchema, m as ssoCallbackQuerySchema, o as credentialsSignInBodySchema, p as refreshResponseSchema, r as capabilitiesResponseSchema, s as credentialsSignUpBodySchema } from "../../auth-CZFXpwba.js";
 import { z } from "zod/v4";
 //#region src/server/handlers/auth.ts

package/dist/server/handlers/author-enrichment.cjs

@@ -7,7 +7,9 @@ require("../../rolldown-runtime-Bd6kNlEP.cjs");
 * - no server config is registered;
 * - `server.auth` is a `MastraAuthConfig`, not a `MastraAuthProvider`.
 */
-function getAuthProvider(mastra) {
+function getAuthProvider(mastra, isStudio) {
+	const studioAuth = isStudio ? mastra.getStudio?.()?.auth : void 0;
+	if (studioAuth && typeof studioAuth.authenticateToken === "function") return studioAuth;
 	const serverConfig = mastra.getServer?.();
 	if (!serverConfig?.auth) return null;
 	if (typeof serverConfig.auth.authenticateToken === "function") return serverConfig.auth;
@@ -45,8 +47,8 @@ function projectUser(user) {
 * The returned map is keyed by the **requested** ID (not the user's `id`
 * field) to be robust against providers that normalize identifiers.
 */
-async function prepareAuthorEnrichment(mastra, _requestContext, authorIds) {
-	const provider = getAuthProvider(mastra);
+async function prepareAuthorEnrichment(mastra, _requestContext, authorIds, isStudio = false) {
+	const provider = getAuthProvider(mastra, isStudio);
 	if (!provider || !isUserProvider(provider)) return null;
 	const uniqueIds = dedupeIds(authorIds);
 	if (uniqueIds.length === 0) return /* @__PURE__ */ new Map();

package/dist/server/handlers/author-enrichment.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"author-enrichment.cjs","names":[],"sources":["../../../src/server/handlers/author-enrichment.ts"],"sourcesContent":["import type { Mastra } from '@mastra/core';\nimport type { IUserProvider, User } from '@mastra/core/auth';\nimport type { RequestContext } from '@mastra/core/di';\nimport type { IMastraAuthProvider } from '@mastra/core/server';\n\n/**\n * Public-safe resolved author shape — same fields exposed by `/auth/me`.\n * Provider-specific extras are intentionally stripped to avoid leaking\n * unexpected data through the stored-agent (and future stored-resource) APIs.\n */\nexport type ResolvedAuthor = {\n  id: string;\n  name?: string;\n  email?: string;\n  avatarUrl?: string;\n};\n\n/**\n * Locate the auth provider from a Mastra instance using the same\n * private helper pattern as `auth.ts`. Returns null when:\n * - no server config is registered;\n * - `server.auth` is a `MastraAuthConfig`, not a `MastraAuthProvider`.\n */\nfunction getAuthProvider(mastra: Mastra): IMastraAuthProvider | null {\n  const serverConfig = (mastra as { getServer?: () => { auth?: unknown } }).getServer?.();\n  if (!serverConfig?.auth) return null;\n  if (typeof (serverConfig.auth as { authenticateToken?: unknown }).authenticateToken === 'function') {\n    return serverConfig.auth as IMastraAuthProvider;\n  }\n  return null;\n}\n\nfunction isUserProvider(p: unknown): p is IUserProvider {\n  return (\n    p !== null &&\n    typeof p === 'object' &&\n    typeof (p as { getCurrentUser?: unknown }).getCurrentUser === 'function' &&\n    typeof (p as { getUser?: unknown }).getUser === 'function'\n  );\n}\n\nfunction dedupeIds(authorIds: ReadonlyArray<string | null | undefined>): string[] {\n  const set = new Set<string>();\n  for (const id of authorIds) {\n    if (typeof id === 'string' && id.length > 0) set.add(id);\n  }\n  return Array.from(set);\n}\n\nfunction projectUser(user: User | null): Omit<ResolvedAuthor, 'id'> | null {\n  if (!user) return null;\n  const out: Omit<ResolvedAuthor, 'id'> = {};\n  if (typeof user.name === 'string') out.name = user.name;\n  if (typeof user.email === 'string') out.email = user.email;\n  if (typeof user.avatarUrl === 'string') out.avatarUrl = user.avatarUrl;\n  return out;\n}\n\n/**\n * Resolve a set of author IDs against the configured auth provider in one\n * shot. Soft-gated: returns `null` when there is no auth provider, the\n * provider does not implement `IUserProvider`, or the input has no valid\n * IDs to look up. Callers should treat `null` as \"do not attach an `author`\n * field\" so behavior matches setups without user awareness.\n *\n * When the provider exposes the optional `getUsers` batch method, the helper\n * calls it once with the deduped ID list. Otherwise it falls back to\n * `Promise.all(getUser(id))`, parallelized per unique ID. Provider errors\n * per ID are caught and treated as \"unresolved\" — they do not reject the\n * enrichment call.\n *\n * The returned map is keyed by the **requested** ID (not the user's `id`\n * field) to be robust against providers that normalize identifiers.\n */\nexport async function prepareAuthorEnrichment(\n  mastra: Mastra,\n  _requestContext: RequestContext,\n  authorIds: ReadonlyArray<string | null | undefined>,\n): Promise<Map<string, ResolvedAuthor> | null> {\n  const provider = getAuthProvider(mastra);\n  if (!provider || !isUserProvider(provider)) return null;\n\n  const uniqueIds = dedupeIds(authorIds);\n  if (uniqueIds.length === 0) return new Map();\n\n  let users: Array<User | null>;\n  if (typeof provider.getUsers === 'function') {\n    try {\n      users = await provider.getUsers(uniqueIds);\n    } catch {\n      // Batch lookup failed entirely — degrade gracefully to \"no enrichment\"\n      return new Map();\n    }\n  } else {\n    users = await Promise.all(uniqueIds.map(id => provider.getUser(id).catch((): User | null => null)));\n  }\n\n  const map = new Map<string, ResolvedAuthor>();\n  uniqueIds.forEach((id, index) => {\n    const projected = projectUser(users[index] ?? null);\n    if (projected !== null) {\n      map.set(id, { id, ...projected });\n    }\n  });\n  return map;\n}\n\n/**\n * Attach a resolved `author` to a record by looking it up in the map by\n * `record.authorId`. When `authors` is `null` (feature off) or the id is\n * missing from the map, the record passes through unchanged.\n */\nexport function attachAuthor<T extends { authorId?: string | null }>(\n  record: T,\n  authors: Map<string, ResolvedAuthor> | null,\n): T & { author?: ResolvedAuthor } {\n  if (!authors) return record;\n  const id = record.authorId;\n  if (typeof id !== 'string' || id.length === 0) return record;\n  const author = authors.get(id);\n  if (!author) return record;\n  return { ...record, author };\n}\n"],"mappings":";;;;;;;;;AAuBA,SAAS,gBAAgB,QAA4C;CACnE,MAAM,eAAgB,OAAoD,YAAY;CACtF,IAAI,CAAC,cAAc,MAAM,OAAO;CAChC,IAAI,OAAQ,aAAa,KAAyC,sBAAsB,YACtF,OAAO,aAAa;CAEtB,OAAO;AACT;AAEA,SAAS,eAAe,GAAgC;CACtD,OACE,MAAM,QACN,OAAO,MAAM,YACb,OAAQ,EAAmC,mBAAmB,cAC9D,OAAQ,EAA4B,YAAY;AAEpD;AAEA,SAAS,UAAU,WAA+D;CAChF,MAAM,sBAAM,IAAI,IAAY;CAC5B,KAAK,MAAM,MAAM,WACf,IAAI,OAAO,OAAO,YAAY,GAAG,SAAS,GAAG,IAAI,IAAI,EAAE;CAEzD,OAAO,MAAM,KAAK,GAAG;AACvB;AAEA,SAAS,YAAY,MAAsD;CACzE,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,MAAkC,CAAC;CACzC,IAAI,OAAO,KAAK,SAAS,UAAU,IAAI,OAAO,KAAK;CACnD,IAAI,OAAO,KAAK,UAAU,UAAU,IAAI,QAAQ,KAAK;CACrD,IAAI,OAAO,KAAK,cAAc,UAAU,IAAI,YAAY,KAAK;CAC7D,OAAO;AACT;;;;;;;;;;;;;;;;;AAkBA,eAAsB,wBACpB,QACA,iBACA,WAC6C;CAC7C,MAAM,WAAW,gBAAgB,MAAM;CACvC,IAAI,CAAC,YAAY,CAAC,eAAe,QAAQ,GAAG,OAAO;CAEnD,MAAM,YAAY,UAAU,SAAS;CACrC,IAAI,UAAU,WAAW,GAAG,uBAAO,IAAI,IAAI;CAE3C,IAAI;CACJ,IAAI,OAAO,SAAS,aAAa,YAC/B,IAAI;EACF,QAAQ,MAAM,SAAS,SAAS,SAAS;CAC3C,QAAQ;EAEN,uBAAO,IAAI,IAAI;CACjB;MAEA,QAAQ,MAAM,QAAQ,IAAI,UAAU,KAAI,OAAM,SAAS,QAAQ,EAAE,CAAC,CAAC,YAAyB,IAAI,CAAC,CAAC;CAGpG,MAAM,sBAAM,IAAI,IAA4B;CAC5C,UAAU,SAAS,IAAI,UAAU;EAC/B,MAAM,YAAY,YAAY,MAAM,UAAU,IAAI;EAClD,IAAI,cAAc,MAChB,IAAI,IAAI,IAAI;GAAE;GAAI,GAAG;EAAU,CAAC;CAEpC,CAAC;CACD,OAAO;AACT;;;;;;AAOA,SAAgB,aACd,QACA,SACiC;CACjC,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,KAAK,OAAO;CAClB,IAAI,OAAO,OAAO,YAAY,GAAG,WAAW,GAAG,OAAO;CACtD,MAAM,SAAS,QAAQ,IAAI,EAAE;CAC7B,IAAI,CAAC,QAAQ,OAAO;CACpB,OAAO;EAAE,GAAG;EAAQ;CAAO;AAC7B"}
+{"version":3,"file":"author-enrichment.cjs","names":[],"sources":["../../../src/server/handlers/author-enrichment.ts"],"sourcesContent":["import type { Mastra } from '@mastra/core';\nimport type { IUserProvider, User } from '@mastra/core/auth';\nimport type { RequestContext } from '@mastra/core/di';\n\n/**\n * Public-safe resolved author shape — same fields exposed by `/auth/me`.\n * Provider-specific extras are intentionally stripped to avoid leaking\n * unexpected data through the stored-agent (and future stored-resource) APIs.\n */\nexport type ResolvedAuthor = {\n  id: string;\n  name?: string;\n  email?: string;\n  avatarUrl?: string;\n};\n\n/**\n * Locate the auth provider from a Mastra instance using the same\n * private helper pattern as `auth.ts`. Returns null when:\n * - no server config is registered;\n * - `server.auth` is a `MastraAuthConfig`, not a `MastraAuthProvider`.\n */\nfunction getAuthProvider(mastra: Mastra, isStudio: boolean): unknown {\n  const studioAuth = isStudio ? mastra.getStudio?.()?.auth : undefined;\n  if (studioAuth && typeof studioAuth.authenticateToken === 'function') return studioAuth;\n  const serverConfig = (mastra as { getServer?: () => { auth?: unknown } }).getServer?.();\n  if (!serverConfig?.auth) return null;\n  if (typeof (serverConfig.auth as { authenticateToken?: unknown }).authenticateToken === 'function') {\n    return serverConfig.auth;\n  }\n  return null;\n}\n\nfunction isUserProvider(p: unknown): p is IUserProvider {\n  return (\n    p !== null &&\n    typeof p === 'object' &&\n    typeof (p as { getCurrentUser?: unknown }).getCurrentUser === 'function' &&\n    typeof (p as { getUser?: unknown }).getUser === 'function'\n  );\n}\n\nfunction dedupeIds(authorIds: ReadonlyArray<string | null | undefined>): string[] {\n  const set = new Set<string>();\n  for (const id of authorIds) {\n    if (typeof id === 'string' && id.length > 0) set.add(id);\n  }\n  return Array.from(set);\n}\n\nfunction projectUser(user: User | null): Omit<ResolvedAuthor, 'id'> | null {\n  if (!user) return null;\n  const out: Omit<ResolvedAuthor, 'id'> = {};\n  if (typeof user.name === 'string') out.name = user.name;\n  if (typeof user.email === 'string') out.email = user.email;\n  if (typeof user.avatarUrl === 'string') out.avatarUrl = user.avatarUrl;\n  return out;\n}\n\n/**\n * Resolve a set of author IDs against the configured auth provider in one\n * shot. Soft-gated: returns `null` when there is no auth provider, the\n * provider does not implement `IUserProvider`, or the input has no valid\n * IDs to look up. Callers should treat `null` as \"do not attach an `author`\n * field\" so behavior matches setups without user awareness.\n *\n * When the provider exposes the optional `getUsers` batch method, the helper\n * calls it once with the deduped ID list. Otherwise it falls back to\n * `Promise.all(getUser(id))`, parallelized per unique ID. Provider errors\n * per ID are caught and treated as \"unresolved\" — they do not reject the\n * enrichment call.\n *\n * The returned map is keyed by the **requested** ID (not the user's `id`\n * field) to be robust against providers that normalize identifiers.\n */\nexport async function prepareAuthorEnrichment(\n  mastra: Mastra,\n  _requestContext: RequestContext,\n  authorIds: ReadonlyArray<string | null | undefined>,\n  isStudio = false,\n): Promise<Map<string, ResolvedAuthor> | null> {\n  const provider = getAuthProvider(mastra, isStudio);\n  if (!provider || !isUserProvider(provider)) return null;\n\n  const uniqueIds = dedupeIds(authorIds);\n  if (uniqueIds.length === 0) return new Map();\n\n  let users: Array<User | null>;\n  if (typeof provider.getUsers === 'function') {\n    try {\n      users = await provider.getUsers(uniqueIds);\n    } catch {\n      // Batch lookup failed entirely — degrade gracefully to \"no enrichment\"\n      return new Map();\n    }\n  } else {\n    users = await Promise.all(uniqueIds.map(id => provider.getUser(id).catch((): User | null => null)));\n  }\n\n  const map = new Map<string, ResolvedAuthor>();\n  uniqueIds.forEach((id, index) => {\n    const projected = projectUser(users[index] ?? null);\n    if (projected !== null) {\n      map.set(id, { id, ...projected });\n    }\n  });\n  return map;\n}\n\n/**\n * Attach a resolved `author` to a record by looking it up in the map by\n * `record.authorId`. When `authors` is `null` (feature off) or the id is\n * missing from the map, the record passes through unchanged.\n */\nexport function attachAuthor<T extends { authorId?: string | null }>(\n  record: T,\n  authors: Map<string, ResolvedAuthor> | null,\n): T & { author?: ResolvedAuthor } {\n  if (!authors) return record;\n  const id = record.authorId;\n  if (typeof id !== 'string' || id.length === 0) return record;\n  const author = authors.get(id);\n  if (!author) return record;\n  return { ...record, author };\n}\n"],"mappings":";;;;;;;;;AAsBA,SAAS,gBAAgB,QAAgB,UAA4B;CACnE,MAAM,aAAa,WAAW,OAAO,YAAY,CAAC,EAAE,OAAO,KAAA;CAC3D,IAAI,cAAc,OAAO,WAAW,sBAAsB,YAAY,OAAO;CAC7E,MAAM,eAAgB,OAAoD,YAAY;CACtF,IAAI,CAAC,cAAc,MAAM,OAAO;CAChC,IAAI,OAAQ,aAAa,KAAyC,sBAAsB,YACtF,OAAO,aAAa;CAEtB,OAAO;AACT;AAEA,SAAS,eAAe,GAAgC;CACtD,OACE,MAAM,QACN,OAAO,MAAM,YACb,OAAQ,EAAmC,mBAAmB,cAC9D,OAAQ,EAA4B,YAAY;AAEpD;AAEA,SAAS,UAAU,WAA+D;CAChF,MAAM,sBAAM,IAAI,IAAY;CAC5B,KAAK,MAAM,MAAM,WACf,IAAI,OAAO,OAAO,YAAY,GAAG,SAAS,GAAG,IAAI,IAAI,EAAE;CAEzD,OAAO,MAAM,KAAK,GAAG;AACvB;AAEA,SAAS,YAAY,MAAsD;CACzE,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,MAAkC,CAAC;CACzC,IAAI,OAAO,KAAK,SAAS,UAAU,IAAI,OAAO,KAAK;CACnD,IAAI,OAAO,KAAK,UAAU,UAAU,IAAI,QAAQ,KAAK;CACrD,IAAI,OAAO,KAAK,cAAc,UAAU,IAAI,YAAY,KAAK;CAC7D,OAAO;AACT;;;;;;;;;;;;;;;;;AAkBA,eAAsB,wBACpB,QACA,iBACA,WACA,WAAW,OACkC;CAC7C,MAAM,WAAW,gBAAgB,QAAQ,QAAQ;CACjD,IAAI,CAAC,YAAY,CAAC,eAAe,QAAQ,GAAG,OAAO;CAEnD,MAAM,YAAY,UAAU,SAAS;CACrC,IAAI,UAAU,WAAW,GAAG,uBAAO,IAAI,IAAI;CAE3C,IAAI;CACJ,IAAI,OAAO,SAAS,aAAa,YAC/B,IAAI;EACF,QAAQ,MAAM,SAAS,SAAS,SAAS;CAC3C,QAAQ;EAEN,uBAAO,IAAI,IAAI;CACjB;MAEA,QAAQ,MAAM,QAAQ,IAAI,UAAU,KAAI,OAAM,SAAS,QAAQ,EAAE,CAAC,CAAC,YAAyB,IAAI,CAAC,CAAC;CAGpG,MAAM,sBAAM,IAAI,IAA4B;CAC5C,UAAU,SAAS,IAAI,UAAU;EAC/B,MAAM,YAAY,YAAY,MAAM,UAAU,IAAI;EAClD,IAAI,cAAc,MAChB,IAAI,IAAI,IAAI;GAAE;GAAI,GAAG;EAAU,CAAC;CAEpC,CAAC;CACD,OAAO;AACT;;;;;;AAOA,SAAgB,aACd,QACA,SACiC;CACjC,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,KAAK,OAAO;CAClB,IAAI,OAAO,OAAO,YAAY,GAAG,WAAW,GAAG,OAAO;CACtD,MAAM,SAAS,QAAQ,IAAI,EAAE;CAC7B,IAAI,CAAC,QAAQ,OAAO;CACpB,OAAO;EAAE,GAAG;EAAQ;CAAO;AAC7B"}

package/dist/server/handlers/author-enrichment.d.ts

@@ -27,7 +27,7 @@ export type ResolvedAuthor = {
  * The returned map is keyed by the **requested** ID (not the user's `id`
  * field) to be robust against providers that normalize identifiers.
  */
-export declare function prepareAuthorEnrichment(mastra: Mastra, _requestContext: RequestContext, authorIds: ReadonlyArray<string | null | undefined>): Promise<Map<string, ResolvedAuthor> | null>;
+export declare function prepareAuthorEnrichment(mastra: Mastra, _requestContext: RequestContext, authorIds: ReadonlyArray<string | null | undefined>, isStudio?: boolean): Promise<Map<string, ResolvedAuthor> | null>;
 /**
  * Attach a resolved `author` to a record by looking it up in the map by
  * `record.authorId`. When `authors` is `null` (feature off) or the id is

package/dist/server/handlers/author-enrichment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"author-enrichment.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/author-enrichment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGtD;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AA2CF;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,cAAc,EAC/B,SAAS,EAAE,aAAa,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAClD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,IAAI,CAAC,CA2B7C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACjE,MAAM,EAAE,CAAC,EACT,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,IAAI,GAC1C,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,cAAc,CAAA;CAAE,CAOjC"}
+{"version":3,"file":"author-enrichment.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/author-enrichment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AA6CF;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,cAAc,EAC/B,SAAS,EAAE,aAAa,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EACnD,QAAQ,UAAQ,GACf,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,IAAI,CAAC,CA2B7C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACjE,MAAM,EAAE,CAAC,EACT,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,IAAI,GAC1C,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,cAAc,CAAA;CAAE,CAOjC"}

package/dist/server/handlers/author-enrichment.js

@@ -5,7 +5,9 @@
 * - no server config is registered;
 * - `server.auth` is a `MastraAuthConfig`, not a `MastraAuthProvider`.
 */
-function getAuthProvider(mastra) {
+function getAuthProvider(mastra, isStudio) {
+	const studioAuth = isStudio ? mastra.getStudio?.()?.auth : void 0;
+	if (studioAuth && typeof studioAuth.authenticateToken === "function") return studioAuth;
 	const serverConfig = mastra.getServer?.();
 	if (!serverConfig?.auth) return null;
 	if (typeof serverConfig.auth.authenticateToken === "function") return serverConfig.auth;
@@ -43,8 +45,8 @@ function projectUser(user) {
 * The returned map is keyed by the **requested** ID (not the user's `id`
 * field) to be robust against providers that normalize identifiers.
 */
-async function prepareAuthorEnrichment(mastra, _requestContext, authorIds) {
-	const provider = getAuthProvider(mastra);
+async function prepareAuthorEnrichment(mastra, _requestContext, authorIds, isStudio = false) {
+	const provider = getAuthProvider(mastra, isStudio);
 	if (!provider || !isUserProvider(provider)) return null;
 	const uniqueIds = dedupeIds(authorIds);
 	if (uniqueIds.length === 0) return /* @__PURE__ */ new Map();

package/dist/server/handlers/author-enrichment.js.map

@@ -1 +1 @@
-{"version":3,"file":"author-enrichment.js","names":[],"sources":["../../../src/server/handlers/author-enrichment.ts"],"sourcesContent":["import type { Mastra } from '@mastra/core';\nimport type { IUserProvider, User } from '@mastra/core/auth';\nimport type { RequestContext } from '@mastra/core/di';\nimport type { IMastraAuthProvider } from '@mastra/core/server';\n\n/**\n * Public-safe resolved author shape — same fields exposed by `/auth/me`.\n * Provider-specific extras are intentionally stripped to avoid leaking\n * unexpected data through the stored-agent (and future stored-resource) APIs.\n */\nexport type ResolvedAuthor = {\n  id: string;\n  name?: string;\n  email?: string;\n  avatarUrl?: string;\n};\n\n/**\n * Locate the auth provider from a Mastra instance using the same\n * private helper pattern as `auth.ts`. Returns null when:\n * - no server config is registered;\n * - `server.auth` is a `MastraAuthConfig`, not a `MastraAuthProvider`.\n */\nfunction getAuthProvider(mastra: Mastra): IMastraAuthProvider | null {\n  const serverConfig = (mastra as { getServer?: () => { auth?: unknown } }).getServer?.();\n  if (!serverConfig?.auth) return null;\n  if (typeof (serverConfig.auth as { authenticateToken?: unknown }).authenticateToken === 'function') {\n    return serverConfig.auth as IMastraAuthProvider;\n  }\n  return null;\n}\n\nfunction isUserProvider(p: unknown): p is IUserProvider {\n  return (\n    p !== null &&\n    typeof p === 'object' &&\n    typeof (p as { getCurrentUser?: unknown }).getCurrentUser === 'function' &&\n    typeof (p as { getUser?: unknown }).getUser === 'function'\n  );\n}\n\nfunction dedupeIds(authorIds: ReadonlyArray<string | null | undefined>): string[] {\n  const set = new Set<string>();\n  for (const id of authorIds) {\n    if (typeof id === 'string' && id.length > 0) set.add(id);\n  }\n  return Array.from(set);\n}\n\nfunction projectUser(user: User | null): Omit<ResolvedAuthor, 'id'> | null {\n  if (!user) return null;\n  const out: Omit<ResolvedAuthor, 'id'> = {};\n  if (typeof user.name === 'string') out.name = user.name;\n  if (typeof user.email === 'string') out.email = user.email;\n  if (typeof user.avatarUrl === 'string') out.avatarUrl = user.avatarUrl;\n  return out;\n}\n\n/**\n * Resolve a set of author IDs against the configured auth provider in one\n * shot. Soft-gated: returns `null` when there is no auth provider, the\n * provider does not implement `IUserProvider`, or the input has no valid\n * IDs to look up. Callers should treat `null` as \"do not attach an `author`\n * field\" so behavior matches setups without user awareness.\n *\n * When the provider exposes the optional `getUsers` batch method, the helper\n * calls it once with the deduped ID list. Otherwise it falls back to\n * `Promise.all(getUser(id))`, parallelized per unique ID. Provider errors\n * per ID are caught and treated as \"unresolved\" — they do not reject the\n * enrichment call.\n *\n * The returned map is keyed by the **requested** ID (not the user's `id`\n * field) to be robust against providers that normalize identifiers.\n */\nexport async function prepareAuthorEnrichment(\n  mastra: Mastra,\n  _requestContext: RequestContext,\n  authorIds: ReadonlyArray<string | null | undefined>,\n): Promise<Map<string, ResolvedAuthor> | null> {\n  const provider = getAuthProvider(mastra);\n  if (!provider || !isUserProvider(provider)) return null;\n\n  const uniqueIds = dedupeIds(authorIds);\n  if (uniqueIds.length === 0) return new Map();\n\n  let users: Array<User | null>;\n  if (typeof provider.getUsers === 'function') {\n    try {\n      users = await provider.getUsers(uniqueIds);\n    } catch {\n      // Batch lookup failed entirely — degrade gracefully to \"no enrichment\"\n      return new Map();\n    }\n  } else {\n    users = await Promise.all(uniqueIds.map(id => provider.getUser(id).catch((): User | null => null)));\n  }\n\n  const map = new Map<string, ResolvedAuthor>();\n  uniqueIds.forEach((id, index) => {\n    const projected = projectUser(users[index] ?? null);\n    if (projected !== null) {\n      map.set(id, { id, ...projected });\n    }\n  });\n  return map;\n}\n\n/**\n * Attach a resolved `author` to a record by looking it up in the map by\n * `record.authorId`. When `authors` is `null` (feature off) or the id is\n * missing from the map, the record passes through unchanged.\n */\nexport function attachAuthor<T extends { authorId?: string | null }>(\n  record: T,\n  authors: Map<string, ResolvedAuthor> | null,\n): T & { author?: ResolvedAuthor } {\n  if (!authors) return record;\n  const id = record.authorId;\n  if (typeof id !== 'string' || id.length === 0) return record;\n  const author = authors.get(id);\n  if (!author) return record;\n  return { ...record, author };\n}\n"],"mappings":";;;;;;;AAuBA,SAAS,gBAAgB,QAA4C;CACnE,MAAM,eAAgB,OAAoD,YAAY;CACtF,IAAI,CAAC,cAAc,MAAM,OAAO;CAChC,IAAI,OAAQ,aAAa,KAAyC,sBAAsB,YACtF,OAAO,aAAa;CAEtB,OAAO;AACT;AAEA,SAAS,eAAe,GAAgC;CACtD,OACE,MAAM,QACN,OAAO,MAAM,YACb,OAAQ,EAAmC,mBAAmB,cAC9D,OAAQ,EAA4B,YAAY;AAEpD;AAEA,SAAS,UAAU,WAA+D;CAChF,MAAM,sBAAM,IAAI,IAAY;CAC5B,KAAK,MAAM,MAAM,WACf,IAAI,OAAO,OAAO,YAAY,GAAG,SAAS,GAAG,IAAI,IAAI,EAAE;CAEzD,OAAO,MAAM,KAAK,GAAG;AACvB;AAEA,SAAS,YAAY,MAAsD;CACzE,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,MAAkC,CAAC;CACzC,IAAI,OAAO,KAAK,SAAS,UAAU,IAAI,OAAO,KAAK;CACnD,IAAI,OAAO,KAAK,UAAU,UAAU,IAAI,QAAQ,KAAK;CACrD,IAAI,OAAO,KAAK,cAAc,UAAU,IAAI,YAAY,KAAK;CAC7D,OAAO;AACT;;;;;;;;;;;;;;;;;AAkBA,eAAsB,wBACpB,QACA,iBACA,WAC6C;CAC7C,MAAM,WAAW,gBAAgB,MAAM;CACvC,IAAI,CAAC,YAAY,CAAC,eAAe,QAAQ,GAAG,OAAO;CAEnD,MAAM,YAAY,UAAU,SAAS;CACrC,IAAI,UAAU,WAAW,GAAG,uBAAO,IAAI,IAAI;CAE3C,IAAI;CACJ,IAAI,OAAO,SAAS,aAAa,YAC/B,IAAI;EACF,QAAQ,MAAM,SAAS,SAAS,SAAS;CAC3C,QAAQ;EAEN,uBAAO,IAAI,IAAI;CACjB;MAEA,QAAQ,MAAM,QAAQ,IAAI,UAAU,KAAI,OAAM,SAAS,QAAQ,EAAE,CAAC,CAAC,YAAyB,IAAI,CAAC,CAAC;CAGpG,MAAM,sBAAM,IAAI,IAA4B;CAC5C,UAAU,SAAS,IAAI,UAAU;EAC/B,MAAM,YAAY,YAAY,MAAM,UAAU,IAAI;EAClD,IAAI,cAAc,MAChB,IAAI,IAAI,IAAI;GAAE;GAAI,GAAG;EAAU,CAAC;CAEpC,CAAC;CACD,OAAO;AACT;;;;;;AAOA,SAAgB,aACd,QACA,SACiC;CACjC,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,KAAK,OAAO;CAClB,IAAI,OAAO,OAAO,YAAY,GAAG,WAAW,GAAG,OAAO;CACtD,MAAM,SAAS,QAAQ,IAAI,EAAE;CAC7B,IAAI,CAAC,QAAQ,OAAO;CACpB,OAAO;EAAE,GAAG;EAAQ;CAAO;AAC7B"}
+{"version":3,"file":"author-enrichment.js","names":[],"sources":["../../../src/server/handlers/author-enrichment.ts"],"sourcesContent":["import type { Mastra } from '@mastra/core';\nimport type { IUserProvider, User } from '@mastra/core/auth';\nimport type { RequestContext } from '@mastra/core/di';\n\n/**\n * Public-safe resolved author shape — same fields exposed by `/auth/me`.\n * Provider-specific extras are intentionally stripped to avoid leaking\n * unexpected data through the stored-agent (and future stored-resource) APIs.\n */\nexport type ResolvedAuthor = {\n  id: string;\n  name?: string;\n  email?: string;\n  avatarUrl?: string;\n};\n\n/**\n * Locate the auth provider from a Mastra instance using the same\n * private helper pattern as `auth.ts`. Returns null when:\n * - no server config is registered;\n * - `server.auth` is a `MastraAuthConfig`, not a `MastraAuthProvider`.\n */\nfunction getAuthProvider(mastra: Mastra, isStudio: boolean): unknown {\n  const studioAuth = isStudio ? mastra.getStudio?.()?.auth : undefined;\n  if (studioAuth && typeof studioAuth.authenticateToken === 'function') return studioAuth;\n  const serverConfig = (mastra as { getServer?: () => { auth?: unknown } }).getServer?.();\n  if (!serverConfig?.auth) return null;\n  if (typeof (serverConfig.auth as { authenticateToken?: unknown }).authenticateToken === 'function') {\n    return serverConfig.auth;\n  }\n  return null;\n}\n\nfunction isUserProvider(p: unknown): p is IUserProvider {\n  return (\n    p !== null &&\n    typeof p === 'object' &&\n    typeof (p as { getCurrentUser?: unknown }).getCurrentUser === 'function' &&\n    typeof (p as { getUser?: unknown }).getUser === 'function'\n  );\n}\n\nfunction dedupeIds(authorIds: ReadonlyArray<string | null | undefined>): string[] {\n  const set = new Set<string>();\n  for (const id of authorIds) {\n    if (typeof id === 'string' && id.length > 0) set.add(id);\n  }\n  return Array.from(set);\n}\n\nfunction projectUser(user: User | null): Omit<ResolvedAuthor, 'id'> | null {\n  if (!user) return null;\n  const out: Omit<ResolvedAuthor, 'id'> = {};\n  if (typeof user.name === 'string') out.name = user.name;\n  if (typeof user.email === 'string') out.email = user.email;\n  if (typeof user.avatarUrl === 'string') out.avatarUrl = user.avatarUrl;\n  return out;\n}\n\n/**\n * Resolve a set of author IDs against the configured auth provider in one\n * shot. Soft-gated: returns `null` when there is no auth provider, the\n * provider does not implement `IUserProvider`, or the input has no valid\n * IDs to look up. Callers should treat `null` as \"do not attach an `author`\n * field\" so behavior matches setups without user awareness.\n *\n * When the provider exposes the optional `getUsers` batch method, the helper\n * calls it once with the deduped ID list. Otherwise it falls back to\n * `Promise.all(getUser(id))`, parallelized per unique ID. Provider errors\n * per ID are caught and treated as \"unresolved\" — they do not reject the\n * enrichment call.\n *\n * The returned map is keyed by the **requested** ID (not the user's `id`\n * field) to be robust against providers that normalize identifiers.\n */\nexport async function prepareAuthorEnrichment(\n  mastra: Mastra,\n  _requestContext: RequestContext,\n  authorIds: ReadonlyArray<string | null | undefined>,\n  isStudio = false,\n): Promise<Map<string, ResolvedAuthor> | null> {\n  const provider = getAuthProvider(mastra, isStudio);\n  if (!provider || !isUserProvider(provider)) return null;\n\n  const uniqueIds = dedupeIds(authorIds);\n  if (uniqueIds.length === 0) return new Map();\n\n  let users: Array<User | null>;\n  if (typeof provider.getUsers === 'function') {\n    try {\n      users = await provider.getUsers(uniqueIds);\n    } catch {\n      // Batch lookup failed entirely — degrade gracefully to \"no enrichment\"\n      return new Map();\n    }\n  } else {\n    users = await Promise.all(uniqueIds.map(id => provider.getUser(id).catch((): User | null => null)));\n  }\n\n  const map = new Map<string, ResolvedAuthor>();\n  uniqueIds.forEach((id, index) => {\n    const projected = projectUser(users[index] ?? null);\n    if (projected !== null) {\n      map.set(id, { id, ...projected });\n    }\n  });\n  return map;\n}\n\n/**\n * Attach a resolved `author` to a record by looking it up in the map by\n * `record.authorId`. When `authors` is `null` (feature off) or the id is\n * missing from the map, the record passes through unchanged.\n */\nexport function attachAuthor<T extends { authorId?: string | null }>(\n  record: T,\n  authors: Map<string, ResolvedAuthor> | null,\n): T & { author?: ResolvedAuthor } {\n  if (!authors) return record;\n  const id = record.authorId;\n  if (typeof id !== 'string' || id.length === 0) return record;\n  const author = authors.get(id);\n  if (!author) return record;\n  return { ...record, author };\n}\n"],"mappings":";;;;;;;AAsBA,SAAS,gBAAgB,QAAgB,UAA4B;CACnE,MAAM,aAAa,WAAW,OAAO,YAAY,CAAC,EAAE,OAAO,KAAA;CAC3D,IAAI,cAAc,OAAO,WAAW,sBAAsB,YAAY,OAAO;CAC7E,MAAM,eAAgB,OAAoD,YAAY;CACtF,IAAI,CAAC,cAAc,MAAM,OAAO;CAChC,IAAI,OAAQ,aAAa,KAAyC,sBAAsB,YACtF,OAAO,aAAa;CAEtB,OAAO;AACT;AAEA,SAAS,eAAe,GAAgC;CACtD,OACE,MAAM,QACN,OAAO,MAAM,YACb,OAAQ,EAAmC,mBAAmB,cAC9D,OAAQ,EAA4B,YAAY;AAEpD;AAEA,SAAS,UAAU,WAA+D;CAChF,MAAM,sBAAM,IAAI,IAAY;CAC5B,KAAK,MAAM,MAAM,WACf,IAAI,OAAO,OAAO,YAAY,GAAG,SAAS,GAAG,IAAI,IAAI,EAAE;CAEzD,OAAO,MAAM,KAAK,GAAG;AACvB;AAEA,SAAS,YAAY,MAAsD;CACzE,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,MAAkC,CAAC;CACzC,IAAI,OAAO,KAAK,SAAS,UAAU,IAAI,OAAO,KAAK;CACnD,IAAI,OAAO,KAAK,UAAU,UAAU,IAAI,QAAQ,KAAK;CACrD,IAAI,OAAO,KAAK,cAAc,UAAU,IAAI,YAAY,KAAK;CAC7D,OAAO;AACT;;;;;;;;;;;;;;;;;AAkBA,eAAsB,wBACpB,QACA,iBACA,WACA,WAAW,OACkC;CAC7C,MAAM,WAAW,gBAAgB,QAAQ,QAAQ;CACjD,IAAI,CAAC,YAAY,CAAC,eAAe,QAAQ,GAAG,OAAO;CAEnD,MAAM,YAAY,UAAU,SAAS;CACrC,IAAI,UAAU,WAAW,GAAG,uBAAO,IAAI,IAAI;CAE3C,IAAI;CACJ,IAAI,OAAO,SAAS,aAAa,YAC/B,IAAI;EACF,QAAQ,MAAM,SAAS,SAAS,SAAS;CAC3C,QAAQ;EAEN,uBAAO,IAAI,IAAI;CACjB;MAEA,QAAQ,MAAM,QAAQ,IAAI,UAAU,KAAI,OAAM,SAAS,QAAQ,EAAE,CAAC,CAAC,YAAyB,IAAI,CAAC,CAAC;CAGpG,MAAM,sBAAM,IAAI,IAA4B;CAC5C,UAAU,SAAS,IAAI,UAAU;EAC/B,MAAM,YAAY,YAAY,MAAM,UAAU,IAAI;EAClD,IAAI,cAAc,MAChB,IAAI,IAAI,IAAI;GAAE;GAAI,GAAG;EAAU,CAAC;CAEpC,CAAC;CACD,OAAO;AACT;;;;;;AAOA,SAAgB,aACd,QACA,SACiC;CACjC,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,KAAK,OAAO;CAClB,IAAI,OAAO,OAAO,YAAY,GAAG,WAAW,GAAG,OAAO;CACtD,MAAM,SAAS,QAAQ,IAAI,EAAE;CAC7B,IAAI,CAAC,QAAQ,OAAO;CACpB,OAAO;EAAE,GAAG;EAAQ;CAAO;AAC7B"}

package/dist/server/handlers/datasets.cjs

@@ -5,18 +5,28 @@ const require_common = require("../../common-DQn8jX5T.cjs");
 const require_route_builder = require("../../route-builder-C8n4ugUf.cjs");
 const require_constants = require("../../constants-4IJp_uzj.cjs");
 const require_server_handlers_error = require("./error.cjs");
-const require_datasets = require("../../datasets-B3DTc52y.cjs");
+const require_datasets = require("../../datasets-BVbtevHd.cjs");
 let zod = require("zod");
 let _mastra_core_agent = require("@mastra/core/agent");
 let _mastra_core_error = require("@mastra/core/error");
 let _mastra_core_llm = require("@mastra/core/llm");
-let _mastra_core_features = require("@mastra/core/features");
 let _mastra_core_request_context = require("@mastra/core/request-context");
+let _mastra_core_features = require("@mastra/core/features");
 //#region src/server/handlers/datasets.ts
 function assertDatasetsAvailable() {
 	if (!_mastra_core_features.coreFeatures.has("datasets")) throw new require_http_exception.HTTPException(501, { message: "Datasets require @mastra/core >= 1.4.0" });
 }
 /**
+* Experiment deletion reaches core through `mastra.datasets.deleteExperiment`,
+* which is newer than the `datasets` feature itself. A core that predates it
+* satisfies `assertDatasetsAvailable` and would then fail at call time with
+* "deleteExperiment is not a function", so gate the newer capability separately
+* and report the version skew as a 501 rather than a 500.
+*/
+function assertExperimentDeletionAvailable() {
+	if (!_mastra_core_features.coreFeatures.has("experiment-deletion")) throw new require_http_exception.HTTPException(501, { message: "Experiment deletion requires a newer @mastra/core with experiment deletion support." });
+}
+/**
 * Recovers the caller-provided request context for a dataset item.
 *
 * Server adapters overwrite the body's `requestContext` field with the live
@@ -371,6 +381,36 @@ const UPDATE_ITEM_ROUTE = require_route_builder.createRoute({
 		}
 	}
 });
+const PURGE_ITEM_ROUTE = require_route_builder.createRoute({
+	method: "DELETE",
+	path: "/datasets/:datasetId/items/:itemId/purge",
+	responseType: "json",
+	pathParamSchema: require_datasets.datasetAndItemIdPathParams,
+	queryParamSchema: require_datasets.tenancyQuerySchema,
+	responseSchema: require_common.successResponseSchema,
+	summary: "Purge dataset item data",
+	description: "Permanently scrubs item data from all dataset versions and linked experiment results",
+	tags: ["Datasets"],
+	requiresAuth: true,
+	handler: async ({ mastra, datasetId, itemId, ...params }) => {
+		assertDatasetsAvailable();
+		if (!_mastra_core_features.coreFeatures.has("dataset-item-purge")) throw new require_http_exception.HTTPException(501, { message: "Dataset item purge requires a newer @mastra/core with dataset purge support." });
+		try {
+			const { organizationId, projectId } = params;
+			const ds = await mastra.datasets.get({
+				id: datasetId,
+				organizationId,
+				projectId
+			});
+			if ((await ds.getItemHistory({ itemId })).length === 0) throw new require_http_exception.HTTPException(404, { message: `Item not found: ${itemId}` });
+			await ds.purgeItem({ itemId });
+			return { success: true };
+		} catch (error) {
+			if (error instanceof _mastra_core_error.MastraError) throw new require_http_exception.HTTPException(getHttpStatusForMastraError(error.id), { message: error.message });
+			return require_server_handlers_error.handleError(error, "Error purging dataset item data");
+		}
+	}
+});
 const DELETE_ITEM_ROUTE = require_route_builder.createRoute({
 	method: "DELETE",
 	path: "/datasets/:datasetId/items/:itemId",
@@ -456,6 +496,37 @@ const EXPERIMENT_REVIEW_SUMMARY_ROUTE = require_route_builder.createRoute({
 		}
 	}
 });
+const DELETE_ANY_EXPERIMENT_ROUTE = require_route_builder.createRoute({
+	method: "DELETE",
+	path: "/experiments/:experimentId",
+	responseType: "json",
+	pathParamSchema: require_datasets.experimentIdPathParams,
+	queryParamSchema: require_datasets.tenancyQuerySchema,
+	responseSchema: require_common.successResponseSchema,
+	summary: "Delete experiment",
+	description: "Deletes an experiment and its results regardless of dataset association (including experiments orphaned by dataset deletion). Also deletes the traces the experiment produced, cascading to their spans and trace-linked scores, feedback, metrics and logs.",
+	tags: ["Experiments"],
+	requiresAuth: true,
+	handler: async ({ mastra, experimentId, ...params }) => {
+		assertDatasetsAvailable();
+		assertExperimentDeletionAvailable();
+		try {
+			const { organizationId, projectId } = params;
+			if (!(organizationId !== void 0 || projectId !== void 0)) {
+				if (!await mastra.datasets.getExperiment({ experimentId })) throw new require_http_exception.HTTPException(404, { message: `Experiment not found: ${experimentId}` });
+			}
+			await mastra.datasets.deleteExperiment({
+				experimentId,
+				...organizationId !== void 0 ? { organizationId } : {},
+				...projectId !== void 0 ? { projectId } : {}
+			});
+			return { success: true };
+		} catch (error) {
+			if (error instanceof _mastra_core_error.MastraError) throw new require_http_exception.HTTPException(getHttpStatusForMastraError(error.id), { message: error.message });
+			return require_server_handlers_error.handleError(error, "Error deleting experiment");
+		}
+	}
+});
 const LIST_EXPERIMENTS_ROUTE = require_route_builder.createRoute({
 	method: "GET",
 	path: "/datasets/:datasetId/experiments",
@@ -667,6 +738,34 @@ const GET_EXPERIMENT_ROUTE = require_route_builder.createRoute({
 		}
 	}
 });
+const DELETE_EXPERIMENT_ROUTE = require_route_builder.createRoute({
+	method: "DELETE",
+	path: "/datasets/:datasetId/experiments/:experimentId",
+	responseType: "json",
+	pathParamSchema: require_datasets.datasetAndExperimentIdPathParams,
+	queryParamSchema: require_datasets.tenancyQuerySchema,
+	responseSchema: require_common.successResponseSchema,
+	summary: "Delete experiment",
+	description: "Deletes an experiment and its results. Also deletes the traces the experiment produced, cascading to their spans and trace-linked scores, feedback, metrics and logs.",
+	tags: ["Datasets"],
+	requiresAuth: true,
+	handler: async ({ mastra, datasetId, experimentId, ...params }) => {
+		assertDatasetsAvailable();
+		assertExperimentDeletionAvailable();
+		try {
+			const { organizationId, projectId } = params;
+			await (await mastra.datasets.get({
+				id: datasetId,
+				organizationId,
+				projectId
+			})).deleteExperiment({ experimentId });
+			return { success: true };
+		} catch (error) {
+			if (error instanceof _mastra_core_error.MastraError) throw new require_http_exception.HTTPException(getHttpStatusForMastraError(error.id), { message: error.message });
+			return require_server_handlers_error.handleError(error, "Error deleting experiment");
+		}
+	}
+});
 const UPDATE_EXPERIMENT_ROUTE = require_route_builder.createRoute({
 	method: "PATCH",
 	path: "/datasets/:datasetId/experiments/:experimentId",
@@ -1091,7 +1190,9 @@ exports.BATCH_INSERT_ITEMS_ROUTE = BATCH_INSERT_ITEMS_ROUTE;
 exports.CLUSTER_FAILURES_ROUTE = CLUSTER_FAILURES_ROUTE;
 exports.COMPARE_EXPERIMENTS_ROUTE = COMPARE_EXPERIMENTS_ROUTE;
 exports.CREATE_DATASET_ROUTE = CREATE_DATASET_ROUTE;
+exports.DELETE_ANY_EXPERIMENT_ROUTE = DELETE_ANY_EXPERIMENT_ROUTE;
 exports.DELETE_DATASET_ROUTE = DELETE_DATASET_ROUTE;
+exports.DELETE_EXPERIMENT_ROUTE = DELETE_EXPERIMENT_ROUTE;
 exports.DELETE_ITEM_ROUTE = DELETE_ITEM_ROUTE;
 exports.EXPERIMENT_REVIEW_SUMMARY_ROUTE = EXPERIMENT_REVIEW_SUMMARY_ROUTE;
 exports.FINALIZE_EXPERIMENT_ROUTE = FINALIZE_EXPERIMENT_ROUTE;
@@ -1107,6 +1208,7 @@ exports.LIST_EXPERIMENTS_ROUTE = LIST_EXPERIMENTS_ROUTE;
 exports.LIST_EXPERIMENT_RESULTS_ROUTE = LIST_EXPERIMENT_RESULTS_ROUTE;
 exports.LIST_ITEMS_ROUTE = LIST_ITEMS_ROUTE;
 exports.LIST_ITEM_VERSIONS_ROUTE = LIST_ITEM_VERSIONS_ROUTE;
+exports.PURGE_ITEM_ROUTE = PURGE_ITEM_ROUTE;
 exports.RUN_EXPERIMENT_ITEM_ROUTE = RUN_EXPERIMENT_ITEM_ROUTE;
 exports.SUBMIT_EXPERIMENT_RESULT_ROUTE = SUBMIT_EXPERIMENT_RESULT_ROUTE;
 exports.TRIGGER_EXPERIMENT_ROUTE = TRIGGER_EXPERIMENT_ROUTE;