@mastra/server 1.76.0-alpha.7 → 1.76.0-alpha.9

package/dist/server/handlers/error.js.map

@@ -1 +1 @@
-{"version":3,"file":"error.js","names":[],"sources":["../../../src/server/handlers/error.ts"],"sourcesContent":["import type { ZodError } from 'zod';\n\nimport { HTTPException } from '../http-exception';\nimport type { StatusCode } from '../http-exception';\nimport type { ApiError } from '../types';\n\n/**\n * Duck-typed interface for ZodError-like objects.\n * Note: Zod v4 uses PropertyKey[] (string | number | symbol) for path.\n */\nexport interface ZodErrorLike {\n  issues: Array<{\n    path: PropertyKey[];\n    message: string;\n  }>;\n}\n\n/**\n * Recognition for `ModelNotAllowedError` from `@mastra/core/agent-builder/ee`.\n *\n * Inlined as a duck check rather than imported so that `handleError` (wired\n * into every route) does not force a load-time dependency on the\n * `@mastra/core/agent-builder/ee` subpath. That subpath only ships in\n * `@mastra/core >= 1.34.0`; deploys whose bundled `@mastra/server` resolves\n * against an older core would otherwise crash at startup with\n * `ERR_MODULE_NOT_FOUND` on `@mastra/core/dist/agent-builder/ee/index.js`.\n */\nconst MODEL_NOT_ALLOWED_CODE = 'MODEL_NOT_ALLOWED';\n\ninterface ModelNotAllowedErrorLike extends Error {\n  code: typeof MODEL_NOT_ALLOWED_CODE;\n  allowed?: unknown;\n  attempted?: unknown;\n  offendingLabel?: string;\n}\n\nfunction isModelNotAllowedError(error: unknown): error is ModelNotAllowedErrorLike {\n  return error instanceof Error && (error as { code?: unknown }).code === MODEL_NOT_ALLOWED_CODE;\n}\n\nconst WORKFLOW_SCHEMA_VALIDATION_FAILED_CODE = 'WORKFLOW_SCHEMA_VALIDATION_FAILED';\n\nfunction isWorkflowSchemaValidationError(error: unknown): error is Error {\n  return error instanceof Error && (error as { id?: unknown }).id === WORKFLOW_SCHEMA_VALIDATION_FAILED_CODE;\n}\n\nconst WORKFLOW_RESUME_ALREADY_CLAIMED_CODE = 'WORKFLOW_RESUME_ALREADY_CLAIMED';\n\nfunction isWorkflowResumeAlreadyClaimedError(error: unknown): error is Error {\n  return error instanceof Error && (error as { id?: unknown }).id === WORKFLOW_RESUME_ALREADY_CLAIMED_CODE;\n}\n\nconst FEEDBACK_REVIEW_STATUS_CONFLICT_CODE = 'OBSERVABILITY_UPDATE_FEEDBACK_REVIEW_STATUS_CONFLICT';\n\nfunction isFeedbackReviewStatusConflictError(error: unknown): error is Error {\n  return error instanceof Error && (error as { id?: unknown }).id === FEEDBACK_REVIEW_STATUS_CONFLICT_CODE;\n}\n\n/**\n * Matches the `OBSERVABILITY_STORAGE_*_NOT_IMPLEMENTED` MastraError the base\n * observability store throws for every optional method a store doesn't\n * implement. Checked by id (not `instanceof`) so it holds across duplicated\n * `@mastra/core` installs.\n */\nfunction isObservabilityStorageNotImplementedError(error: unknown): error is Error {\n  const id = error && typeof error === 'object' && 'id' in error ? error.id : undefined;\n  return typeof id === 'string' && id.startsWith('OBSERVABILITY_STORAGE_') && id.endsWith('_NOT_IMPLEMENTED');\n}\n\n/**\n * Structural check for ZodError instances.\n *\n * Avoids `instanceof ZodError` because consumers can resolve `'zod'` to a\n * different package instance (e.g. `zod@^3`) than the one a server adapter is\n * bundled with (`zod@^4`). In that case `instanceof` is false and validation\n * errors fall through to a generic response that drops field-path information.\n *\n * See https://github.com/mastra-ai/mastra/issues/17167.\n */\nexport function isZodError(error: unknown): error is ZodError<any> {\n  return (\n    !!error &&\n    typeof error === 'object' &&\n    (error as { name?: unknown }).name === 'ZodError' &&\n    Array.isArray((error as { issues?: unknown }).issues)\n  );\n}\n\n/**\n * Formats a ZodError into a structured validation error response.\n * Returns an object with an error message and an array of field-specific issues.\n */\nexport function formatZodError(\n  error: ZodErrorLike,\n  context: string,\n): { error: string; issues: Array<{ field: string; message: string }> } {\n  const issues = error.issues.map(e => ({\n    field: e.path.length > 0 ? e.path.map(p => String(p)).join('.') : 'root',\n    message: e.message,\n  }));\n\n  return {\n    error: `Invalid ${context}`,\n    issues,\n  };\n}\n\n// Helper to handle errors consistently\nexport function handleError(error: unknown, defaultMessage: string): never {\n  if (isModelNotAllowedError(error)) {\n    const body = {\n      error: {\n        code: error.code,\n        message: error.message,\n        allowed: error.allowed,\n        attempted: error.attempted,\n        offendingLabel: error.offendingLabel,\n      },\n    };\n    const res = new Response(JSON.stringify(body), {\n      status: 422,\n      headers: { 'content-type': 'application/json' },\n    });\n    throw new HTTPException(422, {\n      res,\n      message: error.message,\n      cause: error,\n    });\n  }\n\n  // A losing concurrent resume is a conflict on run state, not a malformed request, so it maps\n  // to 409 and clients can distinguish it from a 400/500 and re-read the run.\n  if (isWorkflowResumeAlreadyClaimedError(error)) {\n    throw new HTTPException(409, {\n      message: error.message,\n      stack: error.stack,\n      cause: error,\n    });\n  }\n\n  // The feedback row changed under a review-status update, so the caller re-reads and retries;\n  // that is a conflict, not a broken store.\n  if (isFeedbackReviewStatusConflictError(error)) {\n    throw new HTTPException(409, {\n      message: error.message,\n      stack: error.stack,\n      cause: error,\n    });\n  }\n\n  if (isWorkflowSchemaValidationError(error)) {\n    throw new HTTPException(400, {\n      message: error.message,\n      stack: error.stack,\n      cause: error,\n    });\n  }\n\n  // Optional observability APIs (feedback, metrics, logs, scores, ...) throw\n  // `*_NOT_IMPLEMENTED` on stores that don't support them. That's a missing\n  // capability, not a server fault, so it maps to 501 — which server adapters\n  // log as a warning instead of an error. The message is preserved because\n  // clients match on it to detect unsupported operations. Clients should check\n  // `GET /observability/capabilities` before calling optional routes.\n  if (isObservabilityStorageNotImplementedError(error)) {\n    throw new HTTPException(501, {\n      message: error.message,\n      stack: error.stack,\n      cause: error,\n    });\n  }\n\n  const apiError = error as ApiError;\n\n  const apiErrorStatus = apiError.status || apiError.details?.status || 500;\n\n  throw new HTTPException(apiErrorStatus as StatusCode, {\n    message: apiError.message || defaultMessage,\n    stack: apiError.stack,\n    cause: apiError.cause,\n  });\n}\n"],"mappings":";;;;;;;;;;;;AA2BA,MAAM,yBAAyB;AAS/B,SAAS,uBAAuB,OAAmD;CACjF,OAAO,iBAAiB,SAAU,MAA6B,SAAS;AAC1E;AAEA,MAAM,yCAAyC;AAE/C,SAAS,gCAAgC,OAAgC;CACvE,OAAO,iBAAiB,SAAU,MAA2B,OAAO;AACtE;AAEA,MAAM,uCAAuC;AAE7C,SAAS,oCAAoC,OAAgC;CAC3E,OAAO,iBAAiB,SAAU,MAA2B,OAAO;AACtE;AAEA,MAAM,uCAAuC;AAE7C,SAAS,oCAAoC,OAAgC;CAC3E,OAAO,iBAAiB,SAAU,MAA2B,OAAO;AACtE;;;;;;;AAQA,SAAS,0CAA0C,OAAgC;CACjF,MAAM,KAAK,SAAS,OAAO,UAAU,YAAY,QAAQ,QAAQ,MAAM,KAAK,KAAA;CAC5E,OAAO,OAAO,OAAO,YAAY,GAAG,WAAW,wBAAwB,KAAK,GAAG,SAAS,kBAAkB;AAC5G;;;;;;;;;;;AAYA,SAAgB,WAAW,OAAwC;CACjE,OACE,CAAC,CAAC,SACF,OAAO,UAAU,YAChB,MAA6B,SAAS,cACvC,MAAM,QAAS,MAA+B,MAAM;AAExD;;;;;AAMA,SAAgB,eACd,OACA,SACsE;CACtE,MAAM,SAAS,MAAM,OAAO,KAAI,OAAM;EACpC,OAAO,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,KAAI,MAAK,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI;EAClE,SAAS,EAAE;CACb,EAAE;CAEF,OAAO;EACL,OAAO,WAAW;EAClB;CACF;AACF;AAGA,SAAgB,YAAY,OAAgB,gBAA+B;CACzE,IAAI,uBAAuB,KAAK,GAAG;EACjC,MAAM,OAAO,EACX,OAAO;GACL,MAAM,MAAM;GACZ,SAAS,MAAM;GACf,SAAS,MAAM;GACf,WAAW,MAAM;GACjB,gBAAgB,MAAM;EACxB,EACF;EAKA,MAAM,IAAI,cAAc,KAAK;GAC3B,KAAA,IALc,SAAS,KAAK,UAAU,IAAI,GAAG;IAC7C,QAAQ;IACR,SAAS,EAAE,gBAAgB,mBAAmB;GAChD,CAEI;GACF,SAAS,MAAM;GACf,OAAO;EACT,CAAC;CACH;CAIA,IAAI,oCAAoC,KAAK,GAC3C,MAAM,IAAI,cAAc,KAAK;EAC3B,SAAS,MAAM;EACf,OAAO,MAAM;EACb,OAAO;CACT,CAAC;CAKH,IAAI,oCAAoC,KAAK,GAC3C,MAAM,IAAI,cAAc,KAAK;EAC3B,SAAS,MAAM;EACf,OAAO,MAAM;EACb,OAAO;CACT,CAAC;CAGH,IAAI,gCAAgC,KAAK,GACvC,MAAM,IAAI,cAAc,KAAK;EAC3B,SAAS,MAAM;EACf,OAAO,MAAM;EACb,OAAO;CACT,CAAC;CASH,IAAI,0CAA0C,KAAK,GACjD,MAAM,IAAI,cAAc,KAAK;EAC3B,SAAS,MAAM;EACf,OAAO,MAAM;EACb,OAAO;CACT,CAAC;CAGH,MAAM,WAAW;CAIjB,MAAM,IAAI,cAFa,SAAS,UAAU,SAAS,SAAS,UAAU,KAEhB;EACpD,SAAS,SAAS,WAAW;EAC7B,OAAO,SAAS;EAChB,OAAO,SAAS;CAClB,CAAC;AACH"}
+{"version":3,"file":"error.js","names":[],"sources":["../../../src/server/handlers/error.ts"],"sourcesContent":["import type { ZodError } from 'zod';\n\nimport { HTTPException } from '../http-exception';\nimport type { StatusCode } from '../http-exception';\nimport type { ApiError } from '../types';\n\n/**\n * Duck-typed interface for ZodError-like objects.\n * Note: Zod v4 uses PropertyKey[] (string | number | symbol) for path.\n */\nexport interface ZodErrorLike {\n  issues: Array<{\n    path: PropertyKey[];\n    message: string;\n  }>;\n}\n\n/**\n * Recognition for `ModelNotAllowedError` from `@mastra/core/agent-builder/ee`.\n *\n * Inlined as a duck check rather than imported so that `handleError` (wired\n * into every route) does not force a load-time dependency on the\n * `@mastra/core/agent-builder/ee` subpath. That subpath only ships in\n * `@mastra/core >= 1.34.0`; deploys whose bundled `@mastra/server` resolves\n * against an older core would otherwise crash at startup with\n * `ERR_MODULE_NOT_FOUND` on `@mastra/core/dist/agent-builder/ee/index.js`.\n */\nconst MODEL_NOT_ALLOWED_CODE = 'MODEL_NOT_ALLOWED';\n\ninterface ModelNotAllowedErrorLike extends Error {\n  code: typeof MODEL_NOT_ALLOWED_CODE;\n  allowed?: unknown;\n  attempted?: unknown;\n  offendingLabel?: string;\n}\n\nfunction isModelNotAllowedError(error: unknown): error is ModelNotAllowedErrorLike {\n  return error instanceof Error && (error as { code?: unknown }).code === MODEL_NOT_ALLOWED_CODE;\n}\n\nconst WORKFLOW_SCHEMA_VALIDATION_FAILED_CODE = 'WORKFLOW_SCHEMA_VALIDATION_FAILED';\n\nfunction isWorkflowSchemaValidationError(error: unknown): error is Error {\n  return error instanceof Error && (error as { id?: unknown }).id === WORKFLOW_SCHEMA_VALIDATION_FAILED_CODE;\n}\n\nconst WORKFLOW_RESUME_ALREADY_CLAIMED_CODE = 'WORKFLOW_RESUME_ALREADY_CLAIMED';\n\nfunction isWorkflowResumeAlreadyClaimedError(error: unknown): error is Error {\n  return error instanceof Error && (error as { id?: unknown }).id === WORKFLOW_RESUME_ALREADY_CLAIMED_CODE;\n}\n\n/**\n * Durable agent errors for a request that conflicts with the run's state:\n * another execution owns the run, it is already being recovered, it lost a\n * concurrent claim, or it is suspended (recover). Matched by id, like the\n * other checks here, so the server doesn't depend on core exporting them.\n */\nconst DURABLE_RUN_CONFLICT_CODES = new Set([\n  'DURABLE_AGENT_RUN_ACTIVE',\n  'DURABLE_AGENT_RECOVER_RUN_ACTIVE_LOCALLY',\n  'DURABLE_AGENT_RECOVER_ALREADY_IN_PROGRESS',\n  'DURABLE_AGENT_RECOVER_RUN_SUSPENDED',\n  'DURABLE_AGENT_EXECUTION_CONFLICT',\n]);\n\nfunction isDurableRunConflictError(error: unknown): error is Error {\n  const id = (error as { id?: unknown } | undefined)?.id;\n  return error instanceof Error && typeof id === 'string' && DURABLE_RUN_CONFLICT_CODES.has(id);\n}\n\nconst FEEDBACK_REVIEW_STATUS_CONFLICT_CODE = 'OBSERVABILITY_UPDATE_FEEDBACK_REVIEW_STATUS_CONFLICT';\n\nfunction isFeedbackReviewStatusConflictError(error: unknown): error is Error {\n  return error instanceof Error && (error as { id?: unknown }).id === FEEDBACK_REVIEW_STATUS_CONFLICT_CODE;\n}\n\n/**\n * Matches the `OBSERVABILITY_STORAGE_*_NOT_IMPLEMENTED` MastraError the base\n * observability store throws for every optional method a store doesn't\n * implement. Checked by id (not `instanceof`) so it holds across duplicated\n * `@mastra/core` installs.\n */\nfunction isObservabilityStorageNotImplementedError(error: unknown): error is Error {\n  const id = error && typeof error === 'object' && 'id' in error ? error.id : undefined;\n  return typeof id === 'string' && id.startsWith('OBSERVABILITY_STORAGE_') && id.endsWith('_NOT_IMPLEMENTED');\n}\n\n/**\n * Structural check for ZodError instances.\n *\n * Avoids `instanceof ZodError` because consumers can resolve `'zod'` to a\n * different package instance (e.g. `zod@^3`) than the one a server adapter is\n * bundled with (`zod@^4`). In that case `instanceof` is false and validation\n * errors fall through to a generic response that drops field-path information.\n *\n * See https://github.com/mastra-ai/mastra/issues/17167.\n */\nexport function isZodError(error: unknown): error is ZodError<any> {\n  return (\n    !!error &&\n    typeof error === 'object' &&\n    (error as { name?: unknown }).name === 'ZodError' &&\n    Array.isArray((error as { issues?: unknown }).issues)\n  );\n}\n\n/**\n * Formats a ZodError into a structured validation error response.\n * Returns an object with an error message and an array of field-specific issues.\n */\nexport function formatZodError(\n  error: ZodErrorLike,\n  context: string,\n): { error: string; issues: Array<{ field: string; message: string }> } {\n  const issues = error.issues.map(e => ({\n    field: e.path.length > 0 ? e.path.map(p => String(p)).join('.') : 'root',\n    message: e.message,\n  }));\n\n  return {\n    error: `Invalid ${context}`,\n    issues,\n  };\n}\n\n// Helper to handle errors consistently\nexport function handleError(error: unknown, defaultMessage: string): never {\n  if (isModelNotAllowedError(error)) {\n    const body = {\n      error: {\n        code: error.code,\n        message: error.message,\n        allowed: error.allowed,\n        attempted: error.attempted,\n        offendingLabel: error.offendingLabel,\n      },\n    };\n    const res = new Response(JSON.stringify(body), {\n      status: 422,\n      headers: { 'content-type': 'application/json' },\n    });\n    throw new HTTPException(422, {\n      res,\n      message: error.message,\n      cause: error,\n    });\n  }\n\n  // A losing concurrent resume, or a recover of a run that is live or suspended, is a conflict on\n  // run state, not a malformed request, so it maps to 409 and clients can distinguish it from a\n  // 400/500 and re-read the run.\n  if (isWorkflowResumeAlreadyClaimedError(error) || isDurableRunConflictError(error)) {\n    throw new HTTPException(409, {\n      message: error.message,\n      stack: error.stack,\n      cause: error,\n    });\n  }\n\n  // The feedback row changed under a review-status update, so the caller re-reads and retries;\n  // that is a conflict, not a broken store.\n  if (isFeedbackReviewStatusConflictError(error)) {\n    throw new HTTPException(409, {\n      message: error.message,\n      stack: error.stack,\n      cause: error,\n    });\n  }\n\n  if (isWorkflowSchemaValidationError(error)) {\n    throw new HTTPException(400, {\n      message: error.message,\n      stack: error.stack,\n      cause: error,\n    });\n  }\n\n  // Optional observability APIs (feedback, metrics, logs, scores, ...) throw\n  // `*_NOT_IMPLEMENTED` on stores that don't support them. That's a missing\n  // capability, not a server fault, so it maps to 501 — which server adapters\n  // log as a warning instead of an error. The message is preserved because\n  // clients match on it to detect unsupported operations. Clients should check\n  // `GET /observability/capabilities` before calling optional routes.\n  if (isObservabilityStorageNotImplementedError(error)) {\n    throw new HTTPException(501, {\n      message: error.message,\n      stack: error.stack,\n      cause: error,\n    });\n  }\n\n  const apiError = error as ApiError;\n\n  const apiErrorStatus = apiError.status || apiError.details?.status || 500;\n\n  throw new HTTPException(apiErrorStatus as StatusCode, {\n    message: apiError.message || defaultMessage,\n    stack: apiError.stack,\n    cause: apiError.cause,\n  });\n}\n"],"mappings":";;;;;;;;;;;;AA2BA,MAAM,yBAAyB;AAS/B,SAAS,uBAAuB,OAAmD;CACjF,OAAO,iBAAiB,SAAU,MAA6B,SAAS;AAC1E;AAEA,MAAM,yCAAyC;AAE/C,SAAS,gCAAgC,OAAgC;CACvE,OAAO,iBAAiB,SAAU,MAA2B,OAAO;AACtE;AAEA,MAAM,uCAAuC;AAE7C,SAAS,oCAAoC,OAAgC;CAC3E,OAAO,iBAAiB,SAAU,MAA2B,OAAO;AACtE;;;;;;;AAQA,MAAM,6CAA6B,IAAI,IAAI;CACzC;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,0BAA0B,OAAgC;CACjE,MAAM,KAAM,OAAwC;CACpD,OAAO,iBAAiB,SAAS,OAAO,OAAO,YAAY,2BAA2B,IAAI,EAAE;AAC9F;AAEA,MAAM,uCAAuC;AAE7C,SAAS,oCAAoC,OAAgC;CAC3E,OAAO,iBAAiB,SAAU,MAA2B,OAAO;AACtE;;;;;;;AAQA,SAAS,0CAA0C,OAAgC;CACjF,MAAM,KAAK,SAAS,OAAO,UAAU,YAAY,QAAQ,QAAQ,MAAM,KAAK,KAAA;CAC5E,OAAO,OAAO,OAAO,YAAY,GAAG,WAAW,wBAAwB,KAAK,GAAG,SAAS,kBAAkB;AAC5G;;;;;;;;;;;AAYA,SAAgB,WAAW,OAAwC;CACjE,OACE,CAAC,CAAC,SACF,OAAO,UAAU,YAChB,MAA6B,SAAS,cACvC,MAAM,QAAS,MAA+B,MAAM;AAExD;;;;;AAMA,SAAgB,eACd,OACA,SACsE;CACtE,MAAM,SAAS,MAAM,OAAO,KAAI,OAAM;EACpC,OAAO,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,KAAI,MAAK,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI;EAClE,SAAS,EAAE;CACb,EAAE;CAEF,OAAO;EACL,OAAO,WAAW;EAClB;CACF;AACF;AAGA,SAAgB,YAAY,OAAgB,gBAA+B;CACzE,IAAI,uBAAuB,KAAK,GAAG;EACjC,MAAM,OAAO,EACX,OAAO;GACL,MAAM,MAAM;GACZ,SAAS,MAAM;GACf,SAAS,MAAM;GACf,WAAW,MAAM;GACjB,gBAAgB,MAAM;EACxB,EACF;EAKA,MAAM,IAAI,cAAc,KAAK;GAC3B,KAAA,IALc,SAAS,KAAK,UAAU,IAAI,GAAG;IAC7C,QAAQ;IACR,SAAS,EAAE,gBAAgB,mBAAmB;GAChD,CAEI;GACF,SAAS,MAAM;GACf,OAAO;EACT,CAAC;CACH;CAKA,IAAI,oCAAoC,KAAK,KAAK,0BAA0B,KAAK,GAC/E,MAAM,IAAI,cAAc,KAAK;EAC3B,SAAS,MAAM;EACf,OAAO,MAAM;EACb,OAAO;CACT,CAAC;CAKH,IAAI,oCAAoC,KAAK,GAC3C,MAAM,IAAI,cAAc,KAAK;EAC3B,SAAS,MAAM;EACf,OAAO,MAAM;EACb,OAAO;CACT,CAAC;CAGH,IAAI,gCAAgC,KAAK,GACvC,MAAM,IAAI,cAAc,KAAK;EAC3B,SAAS,MAAM;EACf,OAAO,MAAM;EACb,OAAO;CACT,CAAC;CASH,IAAI,0CAA0C,KAAK,GACjD,MAAM,IAAI,cAAc,KAAK;EAC3B,SAAS,MAAM;EACf,OAAO,MAAM;EACb,OAAO;CACT,CAAC;CAGH,MAAM,WAAW;CAIjB,MAAM,IAAI,cAFa,SAAS,UAAU,SAAS,SAAS,UAAU,KAEhB;EACpD,SAAS,SAAS,WAAW;EAC7B,OAAO,SAAS;EAChB,OAAO,SAAS;CAClB,CAAC;AACH"}

package/dist/server/handlers/system.cjs

@@ -90,7 +90,7 @@ const GET_API_SCHEMA_ROUTE = require_route_builder.createRoute({
 	tags: ["System"],
 	requiresAuth: true,
 	handler: async () => {
-		const { buildApiSchemaManifest } = await Promise.resolve().then(() => require("../../api-schema-manifest-oN4Xh7nd.cjs"));
+		const { buildApiSchemaManifest } = await Promise.resolve().then(() => require("../../api-schema-manifest-D8uhDn9F.cjs"));
 		return buildApiSchemaManifest();
 	}
 });

package/dist/server/handlers/system.js

@@ -88,7 +88,7 @@ const GET_API_SCHEMA_ROUTE = createRoute({
 	tags: ["System"],
 	requiresAuth: true,
 	handler: async () => {
-		const { buildApiSchemaManifest } = await import("../../api-schema-manifest-vP0LfsCj.js");
+		const { buildApiSchemaManifest } = await import("../../api-schema-manifest-CJFJVu6Q.js");
 		return buildApiSchemaManifest();
 	}
 });

package/dist/server/server-adapter/index.cjs

@@ -6,7 +6,7 @@ const require_utils = require("../../utils-CfF-SHpC.cjs");
 const require_constants = require("../../constants-6d6tCMH8.cjs");
 const require_server_handlers_error = require("../handlers/error.cjs");
 const require_helpers = require("../../helpers-BL_XfkF0.cjs");
-const require_routes = require("../../routes-BDOVS5PA.cjs");
+const require_routes = require("../../routes-DCDI9nh-.cjs");
 let zod_v4 = require("zod/v4");
 let stream = require("stream");
 let _mastra_core_request_context = require("@mastra/core/request-context");
@@ -583,6 +583,22 @@ function parseComplexQueryParams(queryParamSchema, params) {
 	return parsedParams;
 }
 /**
+* Property names that must never be written onto objects built from untrusted
+* input: assigning them can mutate the object's prototype chain.
+*/
+const UNSAFE_OBJECT_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"prototype",
+	"constructor"
+]);
+/**
+* Returns whether `key` is safe to use as a property name when building an
+* object from untrusted input (query strings, form fields, etc.).
+*/
+function isSafeObjectKey(key) {
+	return !UNSAFE_OBJECT_KEYS.has(key);
+}
+/**
 * Normalizes query parameters from various HTTP framework formats to a consistent structure.
 * Handles both single string values and arrays (for repeated query params like ?tag=a&tag=b).
 * Reconstructs bracket-notation keys (e.g., `orderBy[field]=createdAt`) into JSON strings
@@ -601,17 +617,19 @@ function normalizeQueryParams(rawQuery) {
 			const parent = bracketMatch[1];
 			const child = bracketMatch[2];
 			const strValue = Array.isArray(value) ? value.filter((v) => typeof v === "string")[0] : typeof value === "string" ? value : void 0;
-			if (strValue !== void 0) {
-				if (!bracketGroups[parent]) bracketGroups[parent] = {};
+			if (strValue !== void 0 && isSafeObjectKey(parent) && isSafeObjectKey(child)) {
+				if (!Object.hasOwn(bracketGroups, parent)) bracketGroups[parent] = {};
 				bracketGroups[parent][child] = strValue;
 			}
-		} else if (typeof value === "string") queryParams[key] = value;
-		else if (Array.isArray(value)) {
+		} else if (typeof value === "string") {
+			if (isSafeObjectKey(key)) queryParams[key] = value;
+		} else if (Array.isArray(value)) {
+			if (!isSafeObjectKey(key)) continue;
 			const stringValues = value.filter((v) => typeof v === "string");
 			queryParams[key] = stringValues.length === 1 ? stringValues[0] : stringValues;
 		}
 	}
-	for (const [parent, children] of Object.entries(bracketGroups)) if (!(parent in queryParams)) queryParams[parent] = JSON.stringify(children);
+	for (const [parent, children] of Object.entries(bracketGroups)) if (!Object.hasOwn(queryParams, parent)) queryParams[parent] = JSON.stringify(children);
 	return queryParams;
 }
 /**
@@ -1339,6 +1357,7 @@ exports.getCustomHTTPExceptionResponse = getCustomHTTPExceptionResponse;
 exports.getEffectivePermission = getEffectivePermission;
 exports.getFGAProvider = getFGAProvider;
 exports.isReservedRequestContextKey = require_constants.isReservedRequestContextKey;
+exports.isSafeObjectKey = isSafeObjectKey;
 exports.isStudioClientTypeHeader = require_constants.isStudioClientTypeHeader;
 exports.isZodError = require_server_handlers_error.isZodError;
 exports.jsonQueryParam = require_route_builder.jsonQueryParam;