fix(deps): update dependency @mastra/libsql to v1

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@mastra/libsql (source)	^0.12.0 → ^1.0.0

---

Release Notes

mastra-ai/mastra (@​mastra/libsql)

v1.17.0

Compare Source

Minor Changes

• Added LibSQLFactoryStorage for persisting Mastra agent state and lifecycle-managed application domains through one LibSQL connection. (#​19681)

  import { LibSQLFactoryStorage } from '@​mastra/libsql';
  
  const storage = new LibSQLFactoryStorage({ url: 'file:mastra.db' });
  await storage.init();

Patch Changes

• Replaced GitHub-specific Mastra Code session state with Factory project and linked-repository identities. This lets SDK consumers represent sessions independently of a source-control provider and select a repository explicitly when sandbox execution is required. (#​19849)

  Updated Mastra Code onboarding to be Factory-first: create a Factory by name, then link repositories from your connected source-control installations in a separate step. A Factory is valid with zero linked repositories, and the Board, Metrics, and Audit pages stay available for any server-backed Factory. Factory pages keep project-scoped data separate from repository-scoped intake and provide a repository selector when a Factory has multiple linked repositories. Creating a Factory from a local folder remains available as a secondary option.

  Before

  const state = { githubProjectId: 'project-1', sandboxId, sandboxWorkdir };

  After

  const state = {
    factoryProjectId: 'factory-project-1',
    projectRepositoryId: 'project-repository-1',
    sandboxId,
    sandboxWorkdir,
  };

• Fixed an uncaught RangeError: Maximum call stack size exceeded when writing deeply-nested values (such as a long chained Error.cause) to LibSQL storage. safeStringify now caps its recursion depth and substitutes a "[Max depth exceeded]" sentinel instead of overflowing the stack. (#​19610)

• Fix factory storage error classification and schema drift handling. (#​20002)

  • isUniqueViolation in the LibSQL factory storage now only matches real unique-index violations (SQLITE_CONSTRAINT_UNIQUE / SQLITE_CONSTRAINT_PRIMARYKEY). Previously any SQLITE_CONSTRAINT failure — including NOT NULL violations — was reported as a "Unique constraint violation", which masked the real error (seen as Unique constraint violation on collection 'factory_rule_evaluations' when polled ingestion inserted nullable columns into a stale table).
  • ensureCollections in both the LibSQL and Postgres factory storage adapters now relaxes stale NOT NULL constraints when a column becomes nullable in the schema. Postgres uses ALTER COLUMN ... DROP NOT NULL; LibSQL rebuilds the table in place since SQLite cannot drop NOT NULL directly. Existing rows and unique indexes are preserved.

• Updated dependencies [ec857fc, d7385ad, 41a5392, 3d6e539, 1426af2, a40adeb, 8a0d145, bd2f1d2, e1f2fae, 63aa799, b7e79c3, 675fbff, da009e1, 3b77e77, c7d30cd, 21a0eb8, 8b20926, 975295d, 73db8db, 6b1bf3b, 35c2181, 0a2c22c, 4cfdd64, b75d749, 821648b, de86fd7, 2745031, b4b7ea8, 3a8024c, 35865a5, 74faf8b, ef03fbc, 675fbff, 70687f7, 1fadac4, 73db8db, 76b7181, 792ec9a, 712b864, 85e4fb5, 0c0e8d7, a7bbe77, 72e437c, 8f7a5de, a7bbe77, 11f6cd9, ef03c0c, 4fb4d88, 4e68363, c328769, 9f7c67a, 3b65e68, 4eba27a, c701be3, db650ce, 232fcbc, 6354eeb, a8799bb, 3d6e539, e3868e2, 9251370, 3491666, c0bec73]:

  • @​mastra/core@​1.52.0

v1.16.0

Compare Source

Minor Changes

• Added atomic caller-defined dataset IDs for idempotent dataset creation across built-in storage adapters. Supplying id to mastra.datasets.create() now creates the dataset once and resolves compatible retries to the persisted record; incompatible immutable identity fields throw DATASET_ID_CONFLICT. (#​19370)

• Added LibSQLVector.close() to release the underlying libsql client. For local file databases it checkpoints the WAL and switches back to journal_mode=DELETE before closing (mirroring LibSQLStore.close()), so the -wal/-shm sidecar files and OS handles are released promptly. Safe to call more than once. (#​19059)

• Added caller-defined dataset item identities for safe retries across all dataset storage adapters. (#​19384)

  Dataset items can now include an externalId when calling addItem or addItems:

  await dataset.addItem({
    externalId: 'source-item-123',
    input: { prompt: 'Hello' },
  });

  Retrying with the same identity and payload returns the existing item. Reusing an identity with different content returns a typed conflict, including during concurrent writes. Updates and deletes preserve the identity, Spanner retries transactions without changing the outcome, and MySQL batch writes now preserve every supported dataset item field.

Patch Changes

• Raised the @mastra/core peer dependency floor to >=1.51.0-0 so the dataset item identity helpers used by the storage adapters are available at runtime. (#​19384)

• Updated dependencies [bd6d240, 0111486, 96a3749, fe1bda0, 25e7c12, 1ce5121, fb8aea3, 4adc391, a5c6337, 3cfc47a, 2bb7817, 51d9870, 5cab274, 7fa27d3, 8b97958, 8410541, a58dcbb, aa38805, 153bd3b, 45a8e65, e955965, 2d22570, 07bb863, c8ed116, 01b338c, a99eae8, 860ef7e, 17e818c, edce8d2, 8a586ec, 4451dfe, 8b7361d, 1d39058, 3927473, dce50dc, fd13f8e, 634caff, f703f87, 3e26c87, 33f2b88, 177010f, 0ad646f, b486abf, 54a51e0, c43f3a9, a5008f2, e2d5f37, 4ce0163, 4378341]:

  • @​mastra/core@​1.51.0

v1.15.1

Compare Source

Patch Changes

• Update @mastra/core peer dependency for the unified schedules API (#​18874)

• Schedule rows persisted with the legacy target.type: 'heartbeat' are now normalized to target.type: 'agent' when read, so existing agent schedules keep firing after the heartbeats-to-schedules rename in @mastra/core. (#​18874)

• Updated dependencies [b291760, 3ffb8b7, 6ef59fe, 4039488, 29b7ea6, b2c9d70, a51c63d, 252f63d, 5ea76a7, 6445560, e2b9f33, 10959d5, c547a77, a0085fa, a2ba369, ffc3c17, 81542c1, 3908e53, cb24ce7, 02705fd, ae51e81, 6f304ef, 5f9858f]:

  • @​mastra/core@​1.50.0

v1.15.0

Compare Source

Minor Changes

• Added storage retention support to libSQL. When you set a retention config, LibSQLStore can prune old rows from every growth-table domain: memory (threads, messages, resources by createdAt), threadState (by updatedAt), observability (spans by startedAt), scores (by createdAt), workflows (run snapshots by updatedAt), backgroundTasks (by completedAt, so in-flight tasks are never pruned), experiments (whole runs by completedAt, results cascade with their parent), notifications and harness sessions (by createdAt), and schedules fire history (by actual_fire_at). (#​18733)

  Deletes run in batches so they stay safe on large tables. Anchor-column indexes are created lazily on the first prune() call — never at init — so deployments that don't configure retention pay no extra index overhead. prune() only deletes rows; reclaiming disk (for example a VACUUM on self-hosted libSQL) is left to you to run in a maintenance window.

  const storage = new LibSQLStore({
    id: 'mastra-storage',
    url: 'file:./mastra.db',
    retention: {
      memory: { messages: { maxAge: '30d' } },
      observability: { spans: { maxAge: '7d' } },
    },
  });
  
  await storage.prune();

Patch Changes

• Added optional tenancy arguments to getDataset, updateDataset, and deleteDataset. (#​18750)

  You can now pass organizationId and projectId to scope dataset reads, updates, and deletes to a specific tenant. Reads and updates against a dataset in a different tenant throw DATASET_NOT_FOUND (surfaced as a 404 over HTTP). Deletes silently no-op on a tenancy mismatch — matching the existing "delete non-existent id is a no-op" semantics so cross-tenant existence is never leaked via error timing or status.

  Example

  // Before
  await client.getDataset('abc123');
  await client.deleteDataset('abc123');
  await client.updateDataset({ id: 'abc123', name: 'renamed' });
  
  // After — scope to a tenant
  await client.getDataset('abc123', { organizationId: 'org_a', projectId: 'proj_1' });
  await client.deleteDataset('abc123', { organizationId: 'org_a' });
  await client.updateDataset({ id: 'abc123', name: 'renamed', organizationId: 'org_a' });

• Pushed remaining dataset read filters and pagination down to storage. (#​18710)

  DatasetsManager.list({ filters }) now accepts targetType, targetIds (overlap/union semantics), and name (substring, case-insensitive) in addition to the existing tenancy and candidate filters. Filtering is pushed down to the storage layer so callers no longer have to post-filter results.

  Storage adapters must also be upgraded to the versions listed below to honor the new filters. If a caller is on this version of @mastra/core but on an older storage adapter, the new targetType/targetIds/name filter keys are silently ignored by the adapter — no runtime error, but the filter has no effect and every dataset in the tenancy is returned.

  Dataset.listItems({ version, search, page, perPage }) now applies search and pagination at the storage layer when version is provided alongside any of those. Previously they were silently dropped whenever version was set. The return shape is unchanged: passing only version still returns a bare DatasetItem[] snapshot; passing search, page, or perPage (with or without version) returns the paginated { items, pagination } shape. The bare-array branch is marked @deprecated; prefer passing page / perPage to always receive the paginated shape.

• Fixed a double-encoding bug where createDataset stored targetIds and scorerIds as JSON-encoded strings instead of arrays. This caused the new listDatasets({ filters: { targetIds } }) overlap query to never match. (#​18710)

  Existing rows written before this fix are still double-encoded and will not be matched by the new targetIds filter. They self-heal on the next updateDataset call. Deployments with a long tail of pre-existing datasets should run a one-time backfill (re-encoding targetIds and scorerIds on affected rows) rather than rely on incidental writes; this can be tracked as a follow-up if needed.

• Tenancy-scope experiments getById and delete* on ExperimentsStorage. (#​18770)

  ExperimentsStorage.getExperimentById, getExperimentResultById, deleteExperiment, and deleteExperimentResults used to key on the primary id alone, so any caller who knew the id could read or delete the row regardless of tenant. All four now accept an optional filters: { organizationId?, projectId? } argument that is enforced on every adapter (inmemory, libsql, pg, mysql, mongodb, spanner):

  • On tenancy mismatch, get* returns null at the storage layer.
  • On tenancy mismatch, delete* is a silent no-op.
  • The tenancy predicate is folded into the destructive DML itself (scoped WHERE on the DELETE, an atomic gate + delete inside a transaction, or a scoped subquery for the results cascade). A concurrent tenant swap of the same id between a pre-check and the DELETE cannot let a scoped delete hit another tenant's row.

  Both behaviors match how a missing id already responds, so existence does not leak through error timing or messages.

  The same atomic-DML pattern is also applied to DatasetsStorage.deleteDataset across all 5 store adapters, closing a TOCTOU window between the pre-check and the parent DELETE that was introduced when tenancy filters were originally added.

  Dataset.getExperiment and the shared experiment-ownership gate on Dataset now forward the dataset's tenancy scope to storage, so experiment reads and downstream mutations (list results, update result, delete experiment) reached through a dataset handle are automatically scoped to the owning tenant.

  Legacy calls that omit filters are unchanged, so this is fully backwards-compatible.

  // Before: any caller who knew the id could read/delete across tenants.
  await store.experiments.getExperimentById({ id: experimentId });
  await store.experiments.deleteExperiment({ id: experimentId });
  
  // After: pass the caller's scope; wrong tenant gets null / silent no-op.
  await store.experiments.getExperimentById({
    id: experimentId,
    filters: { organizationId, projectId },
  });
  await store.experiments.deleteExperiment({
    id: experimentId,
    filters: { organizationId, projectId },
  });

• Fixed a cross-tenant data-access issue on datasets by scoping DatasetsManager.get and DatasetsManager.delete to tenancy filters. (#​18750)

  Previously get({ id }) and delete({ id }) looked up a dataset by its primary key alone. Any caller who knew a dataset id could read or delete it regardless of which organizationId / projectId it belonged to. This is now closed at the storage layer via a scoped SQL predicate (option (a) — no fetch-then-assert).

  What changed

  • DatasetsManager.get and DatasetsManager.delete accept optional organizationId and projectId.
  • The tenancy is stashed on the returned Dataset handle and forwarded to every downstream storage call (getDetails, update, addItem, item batch ops, startExperimentAsync).
  • The abstract storage contract (getDatasetById, deleteDataset) gained an optional filters?: DatasetTenancyFilters arg.
  • Item-mutation inputs (AddDatasetItemInput, UpdateDatasetItemInput, BatchInsertItemsInput, BatchDeleteItemsInput) and UpdateDatasetInput accept optional filters for the internal existence check.

  Behavior

  • Omitting tenancy preserves the existing behavior (no predicate added) — fully backwards compatible.
  • On tenancy mismatch, get throws NOT_FOUND (returns null at the storage layer) and delete is a silent no-op — matching how a missing id already behaves, so existence does not leak through error timing or messages.

  Example

  // Before
  const ds = await mastra.datasets.get({ id });
  await mastra.datasets.delete({ id });
  
  // After — scope to a tenant
  const ds = await mastra.datasets.get({ id, organizationId, projectId });
  await mastra.datasets.delete({ id, organizationId, projectId });

• Add optional batchId, datasetId, and datasetItemId fields to persisted scores so saved baseline scores can be grouped as one scoring pass and joined back to the dataset items they came from. (#​18331)

  • scoreTrace() accepts top-level batchId, datasetId, and datasetItemId when persisting a score for a stored trace.
  • ScoreRowData and score save payloads now include nullable batchId, datasetId, and datasetItemId.
  • Built-in stores with explicit score schema or attribute mappings now persist these provenance fields on saved scores.
  • D1, DSQL, MSSQL, and Upstash score stores now apply additive provenance migrations or deterministic score ordering for persisted score reads.

  await scoreTrace({
    storage,
    scorer,
    target: { traceId },
    batchId: 'baseline-batch-1',
    datasetId,
    datasetItemId,
  });

• Added optional organizationId and projectId fields to scores for multi-tenant isolation. Scores can now be saved with tenancy metadata and the listScoresBy* methods accept a filters option to scope results by organization and project. (#​18331)

  await storage.saveScore({ ...score, organizationId: 'org-a', projectId: 'proj-1' });
  
  const result = await storage.listScoresByScorerId({
    scorerId,
    filters: { organizationId: 'org-a', projectId: 'proj-1' },
  });

  projectId identifies the project scope, separate from resourceId which continues to mean the agent memory resource.

• Raise @mastra/core peer floor to >=1.49.0-0 on all storage adapters so the tenancy-related named exports the adapters now consume are guaranteed to exist at install time. (#​18861)

• Scoped getDatasetById and deleteDataset to tenancy filters when the caller passes organizationId / projectId. (#​18750)

  The adapters now push the tenancy predicate into the SQL/query when the new optional filters argument is present. Legacy calls that omit tenancy are unchanged. On mismatch, getDatasetById returns null and deleteDataset is a silent no-op — the cascade delete (dataset items and versions) is gated by a scoped parent pre-check, so cross-tenant data is never touched.

• Added optional organizationId and projectId query parameters to the dataset routes. (#​18750)

  GET /datasets/:datasetId, PATCH /datasets/:datasetId, and DELETE /datasets/:datasetId now accept optional tenancy query parameters. When provided, they are forwarded to mastra.datasets.get / .delete and the operation returns 404 if the dataset does not belong to the requested tenant. Requests that omit the query parameters keep their existing behavior.

  Example

  GET /datasets/abc123?organizationId=org_a&projectId=proj_1
  DELETE /datasets/abc123?organizationId=org_a
  

• Updated dependencies [700619b, 0f69865, 9250acd, 0c3d4bc, cc440a3, 6a61846, 215f9b0, 17369b2, c64c2a8, bcae929, ea6327b, 3439fa8, 85107f2, b33822e, 06e2680, 06ff9e0, d5c11e3, 7f5e1ff, ff80671, b8375c1, dab1257, 1240f05, 705ff39, e6fbd5b, 215f9b0, 24c10d3, 24c10d3, 24c10d3, 6f2026c, 24c10d3, 215f9b0, 215f9b0, 003f35d, f890eda, 1340fb7]:

  • @​mastra/core@​1.49.0

v1.14.3

Compare Source

Patch Changes

• Fixed buffered observation extraction metadata so stored OM chunks keep extracted values and extraction failures across memory storage adapters. (#​18655)

• Updated dependencies [b9a2961, b33c77d, 1274eb3, cdd5f93, 1274eb3, 0ac14ce, 9566d27, 8be63b0, 1009f77, 1b8728a, 23c31de, 0368766, 6f578ac, 345eecc, 1917c53, c01012f, 705ba98, 95857bc, e62c108, 2866f04, ee14cae, e84e791, c2f0b7f, 213feb8, 58e287b, e420b3c, be875ed, 9eefdc0, bfbbb01, 7d112ca]:

  • @​mastra/core@​1.48.0

v1.14.2

Compare Source

Patch Changes

• Fixed persistWorkflowSnapshot resetting a workflow run's createdAt on every re-persist. The default execution engine re-persists a run's snapshot on every step, so createdAt drifted to the last activity time and jumped forward on suspend/resume. Re-persisting now preserves the original createdAt and only advances updatedAt, so listWorkflowRuns ordering, fromDate/toDate filters, and the creation time shown in Studio stay correct. (#​18004)

• Updated dependencies [86623c1, 023766f, 0200e75, 7c9dd77, 7f9ae70, a0509c7, 06e0d63, bf3fe49, 01caf93, 438a971, 9990965, 77518cc, fbeda0c, 8a68844, bb2a13b, 24ceaea, a73cd1a, c0ffa3c, 462a769, 0504bf5, 0b5cc47, 87f38a3, d5fa3cd, fe98ef2, 6ccf67b, 793ea0f, 825d8de, 507a5c4, 5afe423, 307573b, 79b3626, c2c1d7b, 86623c1, 1505c07, f328049, e545228, 3eb852e, ffa09e7, 8c9f1c0, 461a7c5, 4211472, 9e45902, 5c0df77, e940f09]:

  • @​mastra/core@​1.47.0

v1.14.1

Compare Source

Patch Changes

• Added multi-tenant scoping columns (organizationId, projectId) to the experiments domain so experiment records and per-item results inherit the tenancy bucket of their parent dataset. (#​18388)

  Experiment, ExperimentResult, CreateExperimentInput, and AddExperimentResultInput now carry optional organizationId / projectId fields. ListExperimentsInput and ListExperimentResultsInput gain a filters: ExperimentTenancyFilters block (mirrors DatasetTenancyFilters) for scoping queries within a (organizationId, projectId) bucket. Tenancy is hydrated from the parent dataset on createExperiment and denormalized onto each ExperimentResult for efficient tenancy-scoped queries.

  The corresponding columns are also added to the mastra_experiments and mastra_experiment_results table schemas. Existing rows backfill to null, matching the rest of the dataset-tenancy surface.

  This release also clarifies the targetType contract via JSDoc:

  • CreateDatasetInput.targetType remains optional. Datasets without a TargetType are not experiment-eligible — the experiment runner requires a non-null CreateExperimentInput.targetType to resolve an executor.
  • Experiment.targetType / CreateExperimentInput.targetType stay required. An experiment by definition replays inputs against a specific target.

  No behavior change for existing OSS-created experiments; the new fields are additive and optional.

  Example:

  // Create an experiment scoped to a tenancy bucket. When the parent dataset
  // already carries `organizationId` / `projectId`, `runExperiment` hydrates
  // these fields automatically from the dataset record.
  const experiment = await storage.createExperiment({
    name: 'qa-regression',
    datasetId: 'ds_123',
    datasetVersion: 1,
    targetType: 'agent',
    targetId: 'agent_qa',
    totalItems: 10,
    organizationId: 'org_123',
    projectId: 'proj_123',
  });
  
  // List experiments within a tenancy bucket.
  const experiments = await storage.listExperiments({
    pagination: { page: 0, perPage: 20 },
    filters: { organizationId: 'org_123', projectId: 'proj_123' },
  });
  
  // List per-item results within the same bucket.
  const results = await storage.listExperimentResults({
    experimentId: experiment.id,
    pagination: { page: 0, perPage: 50 },
    filters: { organizationId: 'org_123', projectId: 'proj_123' },
  });

• Persist and filter dataset tenancy + candidate identity in storage adapters. (#​18314)

  createDataset now persists organizationId, projectId, candidateKey, and candidateId. listDatasets and listItems accept matching tenancy filters. Dataset items inherit organizationId / projectId from their parent dataset on insert, update, delete, and batch insert/delete — items are never settable per call (item tenancy follows dataset tenancy).

  All new columns are nullable and added retroactively via each adapter's existing column-migration path; no breaking DDL. Existing rows continue to read and write fine; new writes can choose to stamp tenancy.

  await storage.createDataset({
    name: 'candidates/missing-tool-call/incident-123',
    organizationId: 'org_abc',
    projectId: 'project_xyz',
    candidateKey: 'missing-tool-call',
    candidateId: 'incident-123',
  });
  
  await storage.listDatasets({
    pagination: { page: 0, perPage: 20 },
    filters: { organizationId: 'org_abc', projectId: 'project_xyz' },
  });

• Fixed: mastra build output no longer hangs on the first storage-touching request when an app uses LibSQLStore, PostgresStore, or MySQLStore with observational memory. mastra dev was unaffected; only the bundled mastra start output deadlocked. No code changes or bundler.externals workaround required on the app side after upgrading. (#​18302)

• Added storage for item-level tool mocks. Dataset items persist their toolMocks and experiment results persist their toolMockReport, so mocks and run diagnostics survive across sessions. (#​18036)

• Updated dependencies [5bd72d2, 1cc9ee1, 417baae, 65f255a, 74955f9, 30ebaf0, 5704634, 5c4e9a4, 4a88c6e, 417baae, 74955f9, 74955f9, 25961e3, 6a1428a, 87a17ef, e11ff30, 7794d71, 9d2c946, c0eda2b, 7b29f33, c0eda2b, b13925b, f1ec385, e14986f, 24912b1, bf94ec6, a29f371, 7686216, 74955f9, 073f910, 0be490f, 0be490f, ebbe1d3, 974f614, 3818814, 975c59a, 1f97ce5, 74955f9, 7f51548, 64f58c0, 74955f9, ebbe1d3, d95f394, 417baae, 8e25a78, 417baae, f3f0c9d, a5b22d3, 31be1cf, 417baae, 74955f9, 74955f9]:

  • @​mastra/core@​1.46.0

v1.14.0

Compare Source

Minor Changes

• Random bump (#​18178)

Pa

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.