refactor(core,server): manager-layer boolean + debug logs for tenancy-scoped delete observability

[NikAiyer]

What

Adds an observability signal for scoped tenancy misses on datasets and experiments — without changing the storage abstract contract or adding new exports from @mastra/core/storage.

Why

Scoped storage get*ById calls return null and scoped delete* calls silently no-op when tenancy filters don't match. That's the correct posture — throwing would leak cross-tenant existence via error timing or message — but it left operators with no signal at all when scoped ops missed.

How

Abstract contract is unchanged. deleteDataset, deleteExperiment, and deleteExperimentResults still return Promise<void>, matching every other delete in the storage domain. Third-party adapter implementations do not need updating.

Manager-layer boolean. DatasetsManager.delete now returns boolean. It derives that locally by doing a pre-delete scoped getDatasetById probe, then calls the void adapter delete unconditionally. The tiny TOCTOU between probe and delete on concurrent recreate only affects debug-log fidelity — not correctness or the no-existence-leak contract.

Wire behavior change on DELETE /datasets/:id:

• Scoped delete (with organizationId / projectId query params) that targets a missing id or a scope-mismatched row: 200 { success: false }. Legit 404 and scope mismatch remain indistinguishable to preserve the no-leak contract.
• Unscoped delete that targets a missing id: 404 (unchanged — the handler throws DATASET_NOT_FOUND when nothing was deleted and no scope was supplied).

Manager-layer debug logs. DatasetsManager and the Dataset handle emit a debug-level log when a scoped get* returns null or a scoped delete/mutation targets a missing/mismatched record. Payload is plain { op, id, organizationId, projectId } — same identifiers already logged by the HTTP layer for scoped calls. Deployments that sanitize HTTP access logs should apply the same treatment to the debug channel if these identifiers are considered sensitive.

No peer-floor bump needed. Because there are no new named exports from @mastra/core/storage, none of the store adapters need a @mastra/core peer-floor bump.

Test plan

• ✓ pnpm build:core — clean
• ✓ pnpm --filter ./packages/core check — 0 tsc errors
• ✓ pnpm --filter @mastra/{libsql,pg,mysql,mongodb,spanner} build:lib — all clean
• ✓ pnpm build:server — clean
• ✓ pnpm --filter ./packages/server check:core-imports — clean
• ✓ Core focused tests (329) — pass
• ✓ Server dataset handler tests (14) — pass
• _test-utils tenancy suite: adapter-level delete* assertions kept as resolves.toBeUndefined() (abstract contract unchanged)
• Manager-level scoped delete asserts boolean return
• Server handler scope-mismatch delete asserts { success: false } — same shape as a legit 404 to the client

Related: MASTRA-4454

ELI5

This change makes dataset deletes safer and clearer when teams use tenant scoping. If you try to delete something outside your tenant, the system now quietly says “nothing happened” instead of leaking whether that item exists.

Summary

• Moved scoped delete observability into the manager layer for datasets, keeping storage delete contracts unchanged.
• DatasetsManager.delete now returns a boolean based on a scoped pre-check, while still calling the adapter delete as a no-op-safe operation.
• DELETE /datasets/:id now returns { success: false } for scoped mismatches/misses, but still returns 404 for unscoped missing datasets.
• Added debug logs for scoped get* misses and scoped delete/mutation no-ops in DatasetsManager and Dataset, including op, id, organizationId, and projectId.
• Tightened experiment and dataset storage adapter tenancy mismatch handling, plus related docs/comments.
• Updated dataset/server tests to match the new scoped delete behavior.

[changeset-bot]

🦋 Changeset detected

Latest commit: d108562

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 23 packages

Name	Type
@mastra/core	Patch
@mastra/server	Patch
@mastra/code-sdk	Patch
mastracode	Patch
@mastra/mcp-docs-server	Patch
@internal/playground	Patch
@mastra/client-js	Patch
@mastra/opencode	Patch
@mastra/longmemeval	Patch
@mastra/deployer	Patch
@mastra/express	Patch
@mastra/fastify	Patch
@mastra/hono	Patch
@mastra/koa	Patch
@mastra/nestjs	Patch
@mastra/next	Patch
@mastra/tanstack-start	Patch
mastra	Patch
@mastra/deployer-cloud	Patch
@mastra/react	Patch
@mastra/temporal	Patch
@mastra/playground-ui	Patch
create-mastra	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Walkthrough

This PR changes DatasetsManager.delete to return a boolean distinguishing scoped deletion hits from misses, adds debug-level logging for tenancy-scoped read/delete misses in DatasetsManager and Dataset, updates the DELETE /datasets/:id route to return { success: false } on scoped mismatches while preserving 404 for unscoped misses, refactors in-memory experiments tenancy checks, and removes redundant pre-delete existence probes in libsql and mongodb adapters.

Changes

Tenancy-miss observability

Layer / File(s)	Summary
DatasetsManager scoped delete/get miss logging packages/core/src/datasets/manager.ts, packages/core/src/datasets/__tests__/manager.test.ts	delete probes for existing record under scope, computes boolean deleted, logs debug on miss; get/getExperiment log debug on scoped miss; tests updated to expect false and verify scoped deleteDataset call args.
Dataset class scoped ownership miss logging packages/core/src/datasets/dataset.ts	#assertScope, #assertExperimentOwnership, and getExperiment emit debug logs with id/org/project context on scoped ownership check failures.
DELETE /datasets/:id route contract change packages/server/src/server/handlers/datasets.ts, packages/server/src/server/handlers/datasets.test.ts	Handler switches to delete-first flow returning { success: deleted } for scoped calls and throwing DATASET_NOT_FOUND only for unscoped misses; tests updated accordingly with a new unscoped-404 test.
In-memory experiments tenancy mismatch refactor packages/core/src/storage/domains/experiments/inmemory.ts	Combines separate org/project mismatch checks into single orgMismatch/projMismatch computed early returns across four methods.
LibSQL and MongoDB delete no-op simplification stores/libsql/src/storage/domains/datasets/index.ts, stores/mongodb/src/storage/domains/experiments/index.ts	Removes pre-delete existence probes; deletions rely on tenancy-scoped WHERE/filter to become natural no-ops on mismatch.
Storage contract documentation and changeset packages/core/src/storage/domains/datasets/base.ts, packages/core/src/storage/domains/experiments/base.ts, .changeset/tenancy-miss-observability.md	JSDoc contracts clarified for silent no-op semantics; changeset documents boolean return change, debug logging, and route behavior while confirming unchanged abstract storage contract.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• mastra-ai/mastra#18750: Both PRs modify tenancy-scoped dataset get/delete handling in core, with this PR refining the same boolean-return and scoped-miss route semantics.
• mastra-ai/mastra#18770: Shares the tenancy-scope experiments theme, aligning inmemory.ts mismatch handling with related experiment filters enforcement changes.

Suggested labels: Documentation, complexity: high

Suggested reviewers: abhiaiyer91, DanielSLew, wardpeet, TheIsrael1, mfrachet, rase-

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title is descriptive, but it exceeds the length guideline and is not written in imperative mood.	Shorten it to under 50 characters and rephrase it in imperative mood with proper capitalization.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch nikaiyer/mastra-4454-oss-observability-for-silent-tenancy-mismatch-no-ops-in

---

_{Comment @coderabbitai help to get the list of available commands.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mastra-docs-1.x	Ready	Preview, Comment	Jul 14, 2026 9:56pm
mastra-playground-ui	Ready	Preview, Comment	Jul 14, 2026 9:56pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
mastra-studio-preview	Ignored	Preview	Jul 14, 2026 9:56pm

[dane-ai-mastra]

PR triage

Linked issue check skipped for core contributor @NikAiyer.

---

PR complexity score

Factor	Value	Score impact
Files changed	11	+22
Lines changed	269	+15
Author merged PRs	615	-20
Test files changed	Yes	-10
Final score		7

Applied label: complexity: low

---

Changed test gate

Changed tests failed against the base branch as expected.

Label: tests: green ✅

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

stores/libsql/src/storage/domains/datasets/index.ts (1)

410-438: 🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win

Cross-tenant cascade still reaches child rows on a scoped miss. The manager always calls deleteDataset, so this batch runs even when the parent DELETE no-ops. Because the experiment/item/version statements are only filtered by datasetId = ?, they can delete or detach rows for a dataset owned by a different tenant. Fold the tenancy predicate into every statement, or restore the scoped existence guard, so the cascade stays a true no-op on mismatch.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@stores/libsql/src/storage/domains/datasets/index.ts` around lines 410 - 438,
The deleteDataset cascade is not fully tenant-scoped because the child
DELETE/UPDATE statements only filter by datasetId, so a scoped miss can still
affect rows from another tenant. Update the batch built in deleteDataset to
apply the same tenancy predicate used in scopedWhere to every
experiment/version/item statement, or restore a parent existence check before
building the batch, so the cascade remains a true no-op on tenant mismatch.

🧹 Nitpick comments (3)

.changeset/tenancy-miss-observability.md (1)

6-21: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Missing code example for the new public API behavior.

This changeset introduces two consumer-facing behavior changes with no example: DatasetsManager.delete() now returns a meaningful boolean, and DELETE /datasets/:id now returns { success: false } instead of always { success: true } on scoped mismatch. As per path instructions, "If the change is a breaking change or is adding a new feature, ensure that a short code example is provided. This code example should show the public API usage."
[potential_issue]

📝 Suggested addition

 `DELETE /datasets/:id` now returns `{ success: false }` on a scoped miss
 (previously always `{ success: true }`). Unscoped missing-id still returns
 `404`.
+
+```ts
+const deleted = await mastra.datasets.delete({
+  id: datasetId,
+  organizationId,
+  projectId,
+});
+// `deleted` is `false` for both a scoped tenancy mismatch and a truly
+// missing id — the two are indistinguishable by design.
+```

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.changeset/tenancy-miss-observability.md around lines 6 - 21, Add a short
public API example for the new tenancy-miss behavior: show
`DatasetsManager.delete(...)` returning a boolean and note that `false` means
either a scoped mismatch or a missing id, and also show `DELETE /datasets/:id`
returning `{ success: false }` on scoped misses. Place the example near the
changeset content so readers can see how to consume the updated
`datasets.delete` and route behavior without guessing.

Source: Path instructions

packages/server/src/server/handlers/datasets.test.ts (1)

265-277: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Tighten the new 404 test to assert status, like its sibling tests.

Other tenancy tests in this file (e.g. Lines 115-125, 134-145) explicitly assert err instanceof HTTPException and err.status === 404. This new test only checks .rejects.toThrow(), so it wouldn't catch a regression where the handler throws a different error type/status instead of the expected 404.

✅ Suggested tightened assertion

     it('throws 404 when unscoped delete targets a non-existent id (legacy behavior)', async () => {
       // Unscoped callers must still get a 404 on a missing id — this preserves
       // pre-boolean-return behavior for clients that do not send tenancy scope
       // query params. Only scoped calls return `{ success: false }` on miss.
-      await expect(
-        (async () =>
-          DELETE_DATASET_ROUTE.handler({
-            ...createTestServerContext({ mastra }),
-            datasetId: 'ds_does_not_exist',
-          } as any))(),
-      ).rejects.toThrow();
+      const err = await DELETE_DATASET_ROUTE.handler({
+        ...createTestServerContext({ mastra }),
+        datasetId: 'ds_does_not_exist',
+      } as any).then(
+        () => null,
+        (e: unknown) => e,
+      );
+      expect(err).toBeInstanceOf(HTTPException);
+      expect((err as HTTPException).status).toBe(404);
     });

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/server/src/server/handlers/datasets.test.ts` around lines 265 - 277,
The new legacy 404 test in DELETE_DATASET_ROUTE.handler is too loose because it
only checks that an error is thrown. Update the test to match the other tenancy
tests by capturing the rejection and asserting it is an HTTPException with
status 404, using the same DELETE_DATASET_ROUTE and createTestServerContext
setup so it verifies both error type and status.

packages/core/src/datasets/dataset.ts (1)

478-502: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Debug log doesn't distinguish "missing" vs "wrong dataset owner".

Both #assertExperimentOwnership and getExperiment log the same message for two different miss conditions: the experiment truly doesn't exist under scope, vs. it exists but belongs to a different dataset (experiment.datasetId !== this.id). Since this PR is specifically about tenancy-miss observability, distinguishing these cases (e.g., a reason: 'not_found' | 'ownership_mismatch' field) would make the debug logs more actionable for diagnosing scope vs. ownership issues.

Also applies to: 507-527

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/core/src/datasets/dataset.ts` around lines 478 - 502, The debug
logging in `#assertExperimentOwnership` (and the matching getExperiment path)
currently uses one message for two different failure cases, so update the log
payload to distinguish whether the experiment was missing under scope or found
but had a dataset ownership mismatch. Add a clear reason field such as reason:
'not_found' or reason: 'ownership_mismatch' alongside the existing context
(datasetId, experimentId, organizationId, projectId) and set it based on whether
experiment is absent or experiment.datasetId !== this.id.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@stores/libsql/src/storage/domains/datasets/index.ts`:
- Around line 410-438: The deleteDataset cascade is not fully tenant-scoped
because the child DELETE/UPDATE statements only filter by datasetId, so a scoped
miss can still affect rows from another tenant. Update the batch built in
deleteDataset to apply the same tenancy predicate used in scopedWhere to every
experiment/version/item statement, or restore a parent existence check before
building the batch, so the cascade remains a true no-op on tenant mismatch.

---

Nitpick comments:
In @.changeset/tenancy-miss-observability.md:
- Around line 6-21: Add a short public API example for the new tenancy-miss
behavior: show `DatasetsManager.delete(...)` returning a boolean and note that
`false` means either a scoped mismatch or a missing id, and also show `DELETE
/datasets/:id` returning `{ success: false }` on scoped misses. Place the
example near the changeset content so readers can see how to consume the updated
`datasets.delete` and route behavior without guessing.

In `@packages/core/src/datasets/dataset.ts`:
- Around line 478-502: The debug logging in `#assertExperimentOwnership` (and the
matching getExperiment path) currently uses one message for two different
failure cases, so update the log payload to distinguish whether the experiment
was missing under scope or found but had a dataset ownership mismatch. Add a
clear reason field such as reason: 'not_found' or reason: 'ownership_mismatch'
alongside the existing context (datasetId, experimentId, organizationId,
projectId) and set it based on whether experiment is absent or
experiment.datasetId !== this.id.

In `@packages/server/src/server/handlers/datasets.test.ts`:
- Around line 265-277: The new legacy 404 test in DELETE_DATASET_ROUTE.handler
is too loose because it only checks that an error is thrown. Update the test to
match the other tenancy tests by capturing the rejection and asserting it is an
HTTPException with status 404, using the same DELETE_DATASET_ROUTE and
createTestServerContext setup so it verifies both error type and status.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 5a476337-f7e8-4b46-86e5-9d7fb128d68f

📥 Commits

Reviewing files that changed from the base of the PR and between 2e0b377 and 30c9414.

📒 Files selected for processing (11)

• .changeset/tenancy-miss-observability.md
• packages/core/src/datasets/__tests__/manager.test.ts
• packages/core/src/datasets/dataset.ts
• packages/core/src/datasets/manager.ts
• packages/core/src/storage/domains/datasets/base.ts
• packages/core/src/storage/domains/experiments/base.ts
• packages/core/src/storage/domains/experiments/inmemory.ts
• packages/server/src/server/handlers/datasets.test.ts
• packages/server/src/server/handlers/datasets.ts
• stores/libsql/src/storage/domains/datasets/index.ts
• stores/mongodb/src/storage/domains/experiments/index.ts

✅ Files skipped from review due to trivial changes (1)

• packages/core/src/storage/domains/datasets/base.ts