@mastra/express 1.4.11-alpha.0 → 1.4.11-alpha.2

package/dist/index.js

@@ -1,666 +1,576 @@
-import { Busboy } from '@fastify/busboy';
-import { coreAuthMiddleware, findMatchingCustomRoute, isProtectedCustomRoute } from '@mastra/server/auth';
-import { MastraServer as MastraServer$1, redactStreamChunk, serializeStreamChunk, normalizeQueryParams, isZodError, checkRouteFGA } from '@mastra/server/server-adapter';
-import { RequestContext } from '@mastra/core/request-context';
-
-// src/index.ts
-function toWebRequest(req) {
-  const protocol = req.protocol || "http";
-  const host = req.get("host") || "localhost";
-  const url = `${protocol}://${host}${req.originalUrl || req.url}`;
-  const headers = new Headers();
-  for (const [key, value] of Object.entries(req.headers)) {
-    if (!value) continue;
-    if (Array.isArray(value)) {
-      value.forEach((v) => headers.append(key, v));
-    } else {
-      headers.set(key, value);
-    }
-  }
-  return new globalThis.Request(url, {
-    method: req.method,
-    headers
-  });
+import { Busboy } from "@fastify/busboy";
+import { coreAuthMiddleware, findMatchingCustomRoute, isProtectedCustomRoute } from "@mastra/server/auth";
+import { MastraServer as MastraServer$1, checkRouteFGA, isZodError, normalizeQueryParams, redactStreamChunk, serializeStreamChunk } from "@mastra/server/server-adapter";
+import { RequestContext } from "@mastra/core/request-context";
+//#region src/auth-middleware.ts
+function toWebRequest$1(req) {
+	const url = `${req.protocol || "http"}://${req.get("host") || "localhost"}${req.originalUrl || req.url}`;
+	const headers = new Headers();
+	for (const [key, value] of Object.entries(req.headers)) {
+		if (!value) continue;
+		if (Array.isArray(value)) value.forEach((v) => headers.append(key, v));
+		else headers.set(key, value);
+	}
+	return new globalThis.Request(url, {
+		method: req.method,
+		headers
+	});
 }
-function createAuthMiddleware({
-  mastra,
-  requiresAuth = true
-}) {
-  return async (req, res, next) => {
-    if (!requiresAuth) {
-      next();
-      return;
-    }
-    const authConfig = mastra.getServer()?.auth;
-    if (!authConfig) {
-      next();
-      return;
-    }
-    const requestContext = res.locals.requestContext ?? new RequestContext();
-    res.locals.requestContext = requestContext;
-    res.locals.mastra = res.locals.mastra ?? mastra;
-    const path = String(req.path || "/");
-    const method = String(req.method || "GET");
-    const customRouteAuthConfig = new Map(res.locals.customRouteAuthConfig ?? []);
-    customRouteAuthConfig.set(`${method}:${path}`, true);
-    const authHeader = req.headers.authorization;
-    let token = authHeader ? authHeader.replace("Bearer ", "") : null;
-    if (!token && req.query.apiKey) {
-      token = req.query.apiKey || null;
-    }
-    const result = await coreAuthMiddleware({
-      path,
-      method,
-      getHeader: (name) => req.headers[name.toLowerCase()],
-      mastra,
-      authConfig,
-      customRouteAuthConfig,
-      requestContext,
-      rawRequest: toWebRequest(req),
-      token,
-      buildAuthorizeContext: () => toWebRequest(req)
-    });
-    if (result.action === "next") {
-      next();
-      return;
-    }
-    res.status(result.status).json(result.body);
-  };
+function createAuthMiddleware({ mastra, requiresAuth = true }) {
+	return async (req, res, next) => {
+		if (!requiresAuth) {
+			next();
+			return;
+		}
+		const authConfig = mastra.getServer()?.auth;
+		if (!authConfig) {
+			next();
+			return;
+		}
+		const requestContext = res.locals.requestContext ?? new RequestContext();
+		res.locals.requestContext = requestContext;
+		res.locals.mastra = res.locals.mastra ?? mastra;
+		const path = String(req.path || "/");
+		const method = String(req.method || "GET");
+		const customRouteAuthConfig = new Map(res.locals.customRouteAuthConfig ?? []);
+		customRouteAuthConfig.set(`${method}:${path}`, true);
+		const authHeader = req.headers.authorization;
+		let token = authHeader ? authHeader.replace("Bearer ", "") : null;
+		if (!token && req.query.apiKey) token = req.query.apiKey || null;
+		const result = await coreAuthMiddleware({
+			path,
+			method,
+			getHeader: (name) => req.headers[name.toLowerCase()],
+			mastra,
+			authConfig,
+			customRouteAuthConfig,
+			requestContext,
+			rawRequest: toWebRequest$1(req),
+			token,
+			buildAuthorizeContext: () => toWebRequest$1(req)
+		});
+		if (result.action === "next") {
+			next();
+			return;
+		}
+		res.status(result.status).json(result.body);
+	};
 }
-
-// src/index.ts
-var _hasPermissionPromise;
+//#endregion
+//#region src/index.ts
+let _hasPermissionPromise;
 function loadHasPermission() {
-  if (!_hasPermissionPromise) {
-    _hasPermissionPromise = import('@mastra/core/auth/ee').then((m) => m.hasPermission).catch(() => {
-      console.error(
-        "[@mastra/express] Auth features require @mastra/core >= 1.6.0. Please upgrade: npm install @mastra/core@latest"
-      );
-      return void 0;
-    });
-  }
-  return _hasPermissionPromise;
+	if (!_hasPermissionPromise) _hasPermissionPromise = import("@mastra/core/auth/ee").then((m) => m.hasPermission).catch(() => {
+		console.error("[@mastra/express] Auth features require @mastra/core >= 1.6.0. Please upgrade: npm install @mastra/core@latest");
+	});
+	return _hasPermissionPromise;
 }
-function toWebRequest2(req) {
-  const protocol = req.protocol || "http";
-  const host = req.get("host") || "localhost";
-  const url = `${protocol}://${host}${req.originalUrl || req.url}`;
-  const headers = new Headers();
-  for (const [key, value] of Object.entries(req.headers)) {
-    if (value) {
-      if (Array.isArray(value)) {
-        value.forEach((v) => headers.append(key, v));
-      } else {
-        headers.set(key, value);
-      }
-    }
-  }
-  return new globalThis.Request(url, {
-    method: req.method,
-    headers
-  });
+/**
+* Convert Express request to Web API Request for cookie-based auth providers.
+*/
+function toWebRequest(req) {
+	const url = `${req.protocol || "http"}://${req.get("host") || "localhost"}${req.originalUrl || req.url}`;
+	const headers = new Headers();
+	for (const [key, value] of Object.entries(req.headers)) if (value) if (Array.isArray(value)) value.forEach((v) => headers.append(key, v));
+	else headers.set(key, value);
+	return new globalThis.Request(url, {
+		method: req.method,
+		headers
+	});
 }
 var MastraServer = class extends MastraServer$1 {
-  createContextMiddleware() {
-    return async (req, res, next) => {
-      let bodyRequestContext;
-      let paramsRequestContext;
-      if (req.method === "POST" || req.method === "PUT") {
-        const contentType = req.headers["content-type"];
-        if (contentType?.includes("application/json") && req.body) {
-          if (req.body.requestContext) {
-            bodyRequestContext = req.body.requestContext;
-          }
-        }
-      }
-      if (req.method === "GET") {
-        try {
-          const encodedRequestContext = req.query.requestContext;
-          if (typeof encodedRequestContext === "string") {
-            try {
-              paramsRequestContext = JSON.parse(encodedRequestContext);
-            } catch {
-              try {
-                const json = Buffer.from(encodedRequestContext, "base64").toString("utf-8");
-                paramsRequestContext = JSON.parse(json);
-              } catch {
-              }
-            }
-          }
-        } catch {
-        }
-      }
-      const requestContext = this.mergeRequestContext({ paramsRequestContext, bodyRequestContext });
-      this.applyRequestMetadataToContext({
-        requestContext,
-        getHeader: (name) => req.get(name)
-      });
-      res.locals.requestContext = requestContext;
-      res.locals.mastra = this.mastra;
-      res.locals.registeredTools = this.tools || {};
-      if (this.taskStore) {
-        res.locals.taskStore = this.taskStore;
-      }
-      res.locals.customRouteAuthConfig = this.customRouteAuthConfig;
-      const controller = new AbortController();
-      res.on("close", () => {
-        if (!res.writableFinished) {
-          controller.abort();
-        }
-      });
-      res.locals.abortSignal = controller.signal;
-      next();
-    };
-  }
-  async stream(route, res, result) {
-    const streamFormat = route.streamFormat || "stream";
-    if (streamFormat === "sse") {
-      res.setHeader("Content-Type", "text/event-stream");
-      res.setHeader("Cache-Control", "no-cache");
-      res.setHeader("Connection", "keep-alive");
-      res.setHeader("X-Accel-Buffering", "no");
-    } else {
-      res.setHeader("Content-Type", "text/plain");
-    }
-    res.setHeader("Transfer-Encoding", "chunked");
-    res.flushHeaders();
-    if (streamFormat === "sse" && route.sseFlushOnConnect) {
-      res.write(": connected\n\n");
-    }
-    const readableStream = result instanceof ReadableStream ? result : result.fullStream;
-    const reader = readableStream.getReader();
-    try {
-      while (true) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        if (value) {
-          if (streamFormat === "sse" && typeof value === "string" && value.startsWith(":")) {
-            res.write(value);
-            continue;
-          }
-          const shouldRedact = this.streamOptions?.redact ?? true;
-          const outputValue = shouldRedact ? redactStreamChunk(value) : value;
-          const serialized = serializeStreamChunk(outputValue);
-          if (!serialized.ok) {
-            this.mastra.getLogger()?.error("Failed to serialize stream chunk, skipping", {
-              path: route.path,
-              chunkType: outputValue?.type,
-              error: serialized.error.message
-            });
-            continue;
-          }
-          if (streamFormat === "sse") {
-            res.write(`data: ${serialized.json}
-
-`);
-          } else {
-            res.write(serialized.json + "");
-          }
-        }
-      }
-    } catch (error) {
-      this.mastra.getLogger()?.error("Error in stream processing", {
-        error: error instanceof Error ? { message: error.message, stack: error.stack } : error
-      });
-    } finally {
-      res.end();
-    }
-  }
-  async getParams(route, request) {
-    const urlParams = request.params;
-    const queryParams = normalizeQueryParams(request.query);
-    let body;
-    let bodyParseError;
-    if (route.method === "POST" || route.method === "PUT" || route.method === "PATCH" || route.method === "DELETE") {
-      const contentType = request.headers["content-type"] || "";
-      if (contentType.includes("multipart/form-data")) {
-        try {
-          const maxFileSize = route.maxBodySize ?? this.bodyLimitOptions?.maxSize;
-          body = await this.parseMultipartFormData(request, maxFileSize);
-        } catch (error) {
-          this.mastra.getLogger()?.error("Failed to parse multipart form data", {
-            error: error instanceof Error ? { message: error.message, stack: error.stack } : error
-          });
-          if (error instanceof Error && error.message.toLowerCase().includes("size")) {
-            throw error;
-          }
-          bodyParseError = {
-            message: error instanceof Error ? error.message : "Failed to parse multipart form data"
-          };
-        }
-      } else {
-        body = request.body;
-      }
-    }
-    return { urlParams, queryParams, body, bodyParseError };
-  }
-  /**
-   * Parse multipart/form-data using @fastify/busboy.
-   * Converts file uploads to Buffers and parses JSON field values.
-   *
-   * @param request - The Express request object
-   * @param maxFileSize - Optional maximum file size in bytes
-   */
-  parseMultipartFormData(request, maxFileSize) {
-    return new Promise((resolve, reject) => {
-      const result = {};
-      const busboy = new Busboy({
-        headers: {
-          "content-type": request.headers["content-type"]
-        },
-        limits: maxFileSize ? { fileSize: maxFileSize } : void 0
-      });
-      busboy.on("file", (fieldname, file) => {
-        const chunks = [];
-        let limitExceeded = false;
-        file.on("data", (chunk) => {
-          chunks.push(chunk);
-        });
-        file.on("limit", () => {
-          limitExceeded = true;
-          reject(new Error(`File size limit exceeded${maxFileSize ? ` (max: ${maxFileSize} bytes)` : ""}`));
-        });
-        file.on("end", () => {
-          if (!limitExceeded) {
-            result[fieldname] = Buffer.concat(chunks);
-          }
-        });
-      });
-      busboy.on("field", (fieldname, value) => {
-        try {
-          result[fieldname] = JSON.parse(value);
-        } catch {
-          result[fieldname] = value;
-        }
-      });
-      busboy.on("finish", () => {
-        resolve(result);
-      });
-      busboy.on("error", (error) => {
-        reject(error);
-      });
-      request.pipe(busboy);
-    });
-  }
-  async sendResponse(route, response, result, request, prefix) {
-    const resolvedPrefix = prefix ?? this.prefix ?? "";
-    if (result && typeof result === "object" && "__refreshHeaders" in result) {
-      const refreshHeaders = result.__refreshHeaders;
-      for (const [key, value] of Object.entries(refreshHeaders)) {
-        response.setHeader(key, value);
-      }
-      delete result.__refreshHeaders;
-    }
-    if (route.responseType === "json") {
-      response.json(result);
-    } else if (route.responseType === "stream") {
-      await this.stream(route, response, result);
-    } else if (route.responseType === "datastream-response") {
-      const fetchResponse = result;
-      fetchResponse.headers.forEach((value, key) => response.setHeader(key, value));
-      response.status(fetchResponse.status);
-      if (fetchResponse.body) {
-        const reader = fetchResponse.body.getReader();
-        const onResError = (err) => {
-          this.mastra.getLogger()?.error("Error writing datastream response", {
-            error: err instanceof Error ? { message: err.message, stack: err.stack } : err
-          });
-          void reader.cancel("response write error");
-        };
-        response.once("error", onResError);
-        try {
-          while (true) {
-            const { done, value } = await reader.read();
-            if (done) break;
-            response.write(value);
-          }
-        } catch (error) {
-          this.mastra.getLogger()?.error("Error in datastream processing", {
-            error: error instanceof Error ? { message: error.message, stack: error.stack } : error
-          });
-        } finally {
-          response.off("error", onResError);
-          response.end();
-        }
-      } else {
-        response.end();
-      }
-    } else if (route.responseType === "mcp-http") {
-      if (!request) {
-        response.status(500).json({ error: "Request object required for MCP transport" });
-        return;
-      }
-      const { server, httpPath, mcpOptions: routeMcpOptions } = result;
-      try {
-        const options = { ...this.mcpOptions, ...routeMcpOptions };
-        await server.startHTTP({
-          url: new URL(request.url, `http://${request.headers.host}`),
-          httpPath: `${resolvedPrefix}${httpPath}`,
-          req: request,
-          res: response,
-          options: Object.keys(options).length > 0 ? options : void 0
-        });
-      } catch {
-        if (!response.headersSent) {
-          response.status(500).json({
-            jsonrpc: "2.0",
-            error: { code: -32603, message: "Internal server error" },
-            id: null
-          });
-        }
-      }
-    } else if (route.responseType === "mcp-sse") {
-      if (!request) {
-        response.status(500).json({ error: "Request object required for MCP transport" });
-        return;
-      }
-      const { server, ssePath, messagePath } = result;
-      try {
-        await server.startSSE({
-          url: new URL(request.url, `http://${request.headers.host}`),
-          ssePath: `${resolvedPrefix}${ssePath}`,
-          messagePath: `${resolvedPrefix}${messagePath}`,
-          req: request,
-          res: response
-        });
-      } catch {
-        if (!response.headersSent) {
-          response.status(500).json({ error: "Error handling MCP SSE request" });
-        }
-      }
-    } else {
-      response.sendStatus(500);
-    }
-  }
-  async registerRoute(app, route, { prefix: prefixParam } = {}) {
-    const prefix = prefixParam ?? this.prefix ?? "";
-    const shouldApplyBodyLimit = this.bodyLimitOptions && ["POST", "PUT", "PATCH"].includes(route.method.toUpperCase());
-    const maxSize = route.maxBodySize ?? this.bodyLimitOptions?.maxSize;
-    const middlewares = [];
-    if (shouldApplyBodyLimit && maxSize && this.bodyLimitOptions) {
-      const bodyLimitMiddleware = (req, res, next) => {
-        const contentLength = req.headers["content-length"];
-        if (contentLength && parseInt(contentLength, 10) > maxSize) {
-          try {
-            const errorResponse = this.bodyLimitOptions.onError({ error: "Request body too large" });
-            return res.status(413).json(errorResponse);
-          } catch {
-            return res.status(413).json({ error: "Request body too large" });
-          }
-        }
-        next();
-      };
-      middlewares.push(bodyLimitMiddleware);
-    }
-    app[route.method.toLowerCase()](
-      `${prefix}${route.path}`,
-      ...middlewares,
-      async (req, res) => {
-        const authError = await this.checkRouteAuth(route, {
-          path: String(req.path || "/"),
-          method: String(req.method || "GET"),
-          getHeader: (name) => req.headers[name.toLowerCase()],
-          getQuery: (name) => req.query[name],
-          requestContext: res.locals.requestContext,
-          request: toWebRequest2(req),
-          buildAuthorizeContext: () => toWebRequest2(req)
-        });
-        if (authError) {
-          const authResult = authError;
-          if (authResult.headers) {
-            for (const [key, value] of Object.entries(authResult.headers)) {
-              res.setHeader(key, value);
-            }
-          }
-          if (authResult.error) {
-            return res.status(authResult.status).json({ error: authResult.error });
-          }
-        }
-        const params = await this.getParams(route, req);
-        if (params.bodyParseError) {
-          return res.status(400).json({
-            error: "Invalid request body",
-            issues: [{ field: "body", message: params.bodyParseError.message }]
-          });
-        }
-        if (params.queryParams) {
-          try {
-            params.queryParams = await this.parseQueryParams(route, params.queryParams);
-          } catch (error) {
-            this.mastra.getLogger()?.error("Error parsing query params", {
-              error: error instanceof Error ? { message: error.message, stack: error.stack } : error
-            });
-            if (isZodError(error)) {
-              const { status, body } = this.resolveValidationError(route, error, "query");
-              return res.status(status).json(body);
-            }
-            return res.status(400).json({
-              error: "Invalid query parameters",
-              issues: [{ field: "unknown", message: error instanceof Error ? error.message : "Unknown error" }]
-            });
-          }
-        }
-        if (params.body) {
-          try {
-            params.body = await this.parseBody(route, params.body);
-          } catch (error) {
-            this.mastra.getLogger()?.error("Error parsing body", {
-              error: error instanceof Error ? { message: error.message, stack: error.stack } : error
-            });
-            if (isZodError(error)) {
-              const { status, body } = this.resolveValidationError(route, error, "body");
-              return res.status(status).json(body);
-            }
-            return res.status(400).json({
-              error: "Invalid request body",
-              issues: [{ field: "unknown", message: error instanceof Error ? error.message : "Unknown error" }]
-            });
-          }
-        }
-        if (params.urlParams) {
-          try {
-            params.urlParams = await this.parsePathParams(route, params.urlParams);
-          } catch (error) {
-            this.mastra.getLogger()?.error("Error parsing path params", {
-              error: error instanceof Error ? { message: error.message, stack: error.stack } : error
-            });
-            if (isZodError(error)) {
-              const { status, body } = this.resolveValidationError(route, error, "path");
-              return res.status(status).json(body);
-            }
-            return res.status(400).json({
-              error: "Invalid path parameters",
-              issues: [{ field: "unknown", message: error instanceof Error ? error.message : "Unknown error" }]
-            });
-          }
-        }
-        const handlerParams = {
-          ...params.urlParams,
-          ...params.queryParams,
-          ...typeof params.body === "object" ? params.body : {},
-          requestContext: res.locals.requestContext,
-          mastra: this.mastra,
-          registeredTools: res.locals.registeredTools,
-          taskStore: res.locals.taskStore,
-          abortSignal: res.locals.abortSignal,
-          routePrefix: prefix,
-          request: toWebRequest2(req)
-        };
-        const authConfig = this.mastra.getServer()?.auth;
-        if (authConfig) {
-          const hasPermission = await loadHasPermission();
-          if (hasPermission) {
-            const userPermissions = res.locals.requestContext.get("mastra__userPermissions");
-            const permissionError = this.checkRoutePermission(route, userPermissions, hasPermission);
-            if (permissionError) {
-              return res.status(permissionError.status).json({
-                error: permissionError.error,
-                message: permissionError.message
-              });
-            }
-          }
-        }
-        const fgaError = await checkRouteFGA(this.mastra, route, res.locals.requestContext, {
-          ...params.urlParams,
-          ...params.queryParams,
-          ...typeof params.body === "object" ? params.body : {}
-        });
-        if (fgaError) {
-          return res.status(fgaError.status).json({ error: fgaError.error, message: fgaError.message });
-        }
-        try {
-          const result = await route.handler(handlerParams);
-          await this.sendResponse(route, res, result, req, prefix);
-        } catch (error) {
-          const httpStatus = error && typeof error === "object" && "status" in error ? error.status : void 0;
-          const isClientError = typeof httpStatus === "number" && httpStatus >= 400 && httpStatus < 500;
-          if (!isClientError) {
-            this.mastra.getLogger()?.error("Error calling handler", {
-              error: error instanceof Error ? { message: error.message, stack: error.stack } : error,
-              path: route.path,
-              method: route.method
-            });
-          }
-          let status = 500;
-          if (error && typeof error === "object") {
-            if ("status" in error) {
-              status = error.status;
-            } else if ("details" in error && error.details && typeof error.details === "object" && "status" in error.details) {
-              status = error.details.status;
-            }
-          }
-          res.status(status).json({ error: error instanceof Error ? error.message : "Unknown error" });
-        }
-      }
-    );
-  }
-  async registerCustomApiRoutes() {
-    if (!await this.buildCustomRouteHandler()) return;
-    this.app.use(async (req, res, next) => {
-      const path = String(req.path || "/");
-      const method = String(req.method || "GET");
-      const matchedRoute = findMatchingCustomRoute(
-        path,
-        method,
-        this.customApiRoutes ?? this.mastra.getServer()?.apiRoutes
-      );
-      const shouldRunCustomRouteAuth = isProtectedCustomRoute(path, method, this.customRouteAuthConfig);
-      const shouldRunCustomRouteFGA = !!matchedRoute?.route.fga;
-      if (shouldRunCustomRouteAuth || shouldRunCustomRouteFGA) {
-        const serverRoute = {
-          method: matchedRoute?.route.method ?? method,
-          path: matchedRoute?.route.path ?? path,
-          responseType: "json",
-          handler: async () => {
-          },
-          requiresAuth: matchedRoute?.route.requiresAuth,
-          requiresPermission: matchedRoute?.route.requiresPermission,
-          fga: matchedRoute?.route.fga
-        };
-        if (shouldRunCustomRouteAuth) {
-          const authError = await this.checkRouteAuth(serverRoute, {
-            path,
-            method,
-            getHeader: (name) => req.headers[name.toLowerCase()],
-            getQuery: (name) => req.query[name],
-            requestContext: res.locals.requestContext,
-            request: toWebRequest2(req),
-            buildAuthorizeContext: () => toWebRequest2(req)
-          });
-          if (authError) {
-            const authResult = authError;
-            if (authResult.headers) {
-              for (const [key, value] of Object.entries(authResult.headers)) {
-                res.setHeader(key, value);
-              }
-            }
-            if (authResult.error) {
-              return res.status(authResult.status).json({ error: authResult.error });
-            }
-          }
-          const authConfig = this.mastra.getServer()?.auth;
-          if (authConfig) {
-            const hasPermission = await loadHasPermission();
-            if (hasPermission) {
-              const userPermissions = res.locals.requestContext.get("mastra__userPermissions");
-              const permissionError = this.checkRoutePermission(serverRoute, userPermissions, hasPermission);
-              if (permissionError) {
-                return res.status(permissionError.status).json({
-                  error: permissionError.error,
-                  message: permissionError.message
-                });
-              }
-            }
-          }
-        }
-        const fgaError = await checkRouteFGA(this.mastra, serverRoute, res.locals.requestContext, {
-          ...matchedRoute?.params ?? {},
-          ...req.query,
-          ...typeof req.body === "object" && req.body !== null ? req.body : {}
-        });
-        if (fgaError) {
-          return res.status(fgaError.status).json({ error: fgaError.error, message: fgaError.message });
-        }
-      }
-      const response = await this.handleCustomRouteRequest(
-        `${req.protocol}://${req.get("host") || "localhost"}${req.originalUrl}`,
-        req.method,
-        req.headers,
-        req.body,
-        res.locals.requestContext,
-        res.locals.abortSignal
-      );
-      if (!response) return next();
-      await this.writeCustomRouteResponse(response, res, res.locals.abortSignal);
-    });
-  }
-  registerContextMiddleware() {
-    this.app.use(this.createContextMiddleware());
-  }
-  registerAuthMiddleware() {
-  }
-  registerHttpLoggingMiddleware() {
-    if (!this.httpLoggingConfig?.enabled) {
-      return;
-    }
-    this.app.use((req, res, next) => {
-      if (!this.shouldLogRequest(req.path)) {
-        return next();
-      }
-      const start = Date.now();
-      const method = req.method;
-      const path = req.path;
-      res.on("finish", () => {
-        const duration = Date.now() - start;
-        const status = res.statusCode;
-        const level = this.httpLoggingConfig?.level || "info";
-        const logData = {
-          method,
-          path,
-          status,
-          duration: `${duration}ms`
-        };
-        if (this.httpLoggingConfig?.includeQueryParams) {
-          logData.query = req.query;
-        }
-        if (this.httpLoggingConfig?.includeHeaders) {
-          const headers = { ...req.headers };
-          const redactHeaders = this.httpLoggingConfig.redactHeaders || [];
-          redactHeaders.forEach((h) => {
-            const key = h.toLowerCase();
-            if (headers[key] !== void 0) {
-              headers[key] = "[REDACTED]";
-            }
-          });
-          logData.headers = headers;
-        }
-        this.logger[level](`${method} ${path} ${status} ${duration}ms`, logData);
-      });
-      next();
-    });
-  }
+	createContextMiddleware() {
+		return async (req, res, next) => {
+			let bodyRequestContext;
+			let paramsRequestContext;
+			if (req.method === "POST" || req.method === "PUT") {
+				if (req.headers["content-type"]?.includes("application/json") && req.body) {
+					if (req.body.requestContext) bodyRequestContext = req.body.requestContext;
+				}
+			}
+			if (req.method === "GET") try {
+				const encodedRequestContext = req.query.requestContext;
+				if (typeof encodedRequestContext === "string") try {
+					paramsRequestContext = JSON.parse(encodedRequestContext);
+				} catch {
+					try {
+						const json = Buffer.from(encodedRequestContext, "base64").toString("utf-8");
+						paramsRequestContext = JSON.parse(json);
+					} catch {}
+				}
+			} catch {}
+			const requestContext = this.mergeRequestContext({
+				paramsRequestContext,
+				bodyRequestContext
+			});
+			this.applyRequestMetadataToContext({
+				requestContext,
+				getHeader: (name) => req.get(name)
+			});
+			res.locals.requestContext = requestContext;
+			res.locals.mastra = this.mastra;
+			res.locals.registeredTools = this.tools || {};
+			if (this.taskStore) res.locals.taskStore = this.taskStore;
+			res.locals.customRouteAuthConfig = this.customRouteAuthConfig;
+			const controller = new AbortController();
+			res.on("close", () => {
+				if (!res.writableFinished) controller.abort();
+			});
+			res.locals.abortSignal = controller.signal;
+			next();
+		};
+	}
+	async stream(route, res, result) {
+		const streamFormat = route.streamFormat || "stream";
+		if (streamFormat === "sse") {
+			res.setHeader("Content-Type", "text/event-stream");
+			res.setHeader("Cache-Control", "no-cache");
+			res.setHeader("Connection", "keep-alive");
+			res.setHeader("X-Accel-Buffering", "no");
+		} else res.setHeader("Content-Type", "text/plain");
+		res.setHeader("Transfer-Encoding", "chunked");
+		res.flushHeaders();
+		if (streamFormat === "sse" && route.sseFlushOnConnect) res.write(": connected\n\n");
+		const reader = (result instanceof ReadableStream ? result : result.fullStream).getReader();
+		try {
+			while (true) {
+				const { done, value } = await reader.read();
+				if (done) break;
+				if (value) {
+					if (streamFormat === "sse" && typeof value === "string" && value.startsWith(":")) {
+						res.write(value);
+						continue;
+					}
+					const outputValue = this.streamOptions?.redact ?? true ? redactStreamChunk(value) : value;
+					const serialized = serializeStreamChunk(outputValue);
+					if (!serialized.ok) {
+						this.mastra.getLogger()?.error("Failed to serialize stream chunk, skipping", {
+							path: route.path,
+							chunkType: outputValue?.type,
+							error: serialized.error.message
+						});
+						continue;
+					}
+					if (streamFormat === "sse") res.write(`data: ${serialized.json}\n\n`);
+					else res.write(serialized.json + "");
+				}
+			}
+		} catch (error) {
+			this.mastra.getLogger()?.error("Error in stream processing", { error: error instanceof Error ? {
+				message: error.message,
+				stack: error.stack
+			} : error });
+		} finally {
+			res.end();
+		}
+	}
+	async getParams(route, request) {
+		const urlParams = request.params;
+		const queryParams = normalizeQueryParams(request.query);
+		let body;
+		let bodyParseError;
+		if (route.method === "POST" || route.method === "PUT" || route.method === "PATCH" || route.method === "DELETE") if ((request.headers["content-type"] || "").includes("multipart/form-data")) try {
+			const maxFileSize = route.maxBodySize ?? this.bodyLimitOptions?.maxSize;
+			body = await this.parseMultipartFormData(request, maxFileSize);
+		} catch (error) {
+			this.mastra.getLogger()?.error("Failed to parse multipart form data", { error: error instanceof Error ? {
+				message: error.message,
+				stack: error.stack
+			} : error });
+			if (error instanceof Error && error.message.toLowerCase().includes("size")) throw error;
+			bodyParseError = { message: error instanceof Error ? error.message : "Failed to parse multipart form data" };
+		}
+		else body = request.body;
+		return {
+			urlParams,
+			queryParams,
+			body,
+			bodyParseError
+		};
+	}
+	/**
+	* Parse multipart/form-data using @fastify/busboy.
+	* Converts file uploads to Buffers and parses JSON field values.
+	*
+	* @param request - The Express request object
+	* @param maxFileSize - Optional maximum file size in bytes
+	*/
+	parseMultipartFormData(request, maxFileSize) {
+		return new Promise((resolve, reject) => {
+			const result = {};
+			const busboy = new Busboy({
+				headers: { "content-type": request.headers["content-type"] },
+				limits: maxFileSize ? { fileSize: maxFileSize } : void 0
+			});
+			busboy.on("file", (fieldname, file) => {
+				const chunks = [];
+				let limitExceeded = false;
+				file.on("data", (chunk) => {
+					chunks.push(chunk);
+				});
+				file.on("limit", () => {
+					limitExceeded = true;
+					reject(/* @__PURE__ */ new Error(`File size limit exceeded${maxFileSize ? ` (max: ${maxFileSize} bytes)` : ""}`));
+				});
+				file.on("end", () => {
+					if (!limitExceeded) result[fieldname] = Buffer.concat(chunks);
+				});
+			});
+			busboy.on("field", (fieldname, value) => {
+				try {
+					result[fieldname] = JSON.parse(value);
+				} catch {
+					result[fieldname] = value;
+				}
+			});
+			busboy.on("finish", () => {
+				resolve(result);
+			});
+			busboy.on("error", (error) => {
+				reject(error);
+			});
+			request.pipe(busboy);
+		});
+	}
+	async sendResponse(route, response, result, request, prefix) {
+		const resolvedPrefix = prefix ?? this.prefix ?? "";
+		if (result && typeof result === "object" && "__refreshHeaders" in result) {
+			const refreshHeaders = result.__refreshHeaders;
+			for (const [key, value] of Object.entries(refreshHeaders)) response.setHeader(key, value);
+			delete result.__refreshHeaders;
+		}
+		if (route.responseType === "json") response.json(result);
+		else if (route.responseType === "stream") await this.stream(route, response, result);
+		else if (route.responseType === "datastream-response") {
+			const fetchResponse = result;
+			fetchResponse.headers.forEach((value, key) => response.setHeader(key, value));
+			response.status(fetchResponse.status);
+			if (fetchResponse.body) {
+				const reader = fetchResponse.body.getReader();
+				const onResError = (err) => {
+					this.mastra.getLogger()?.error("Error writing datastream response", { error: err instanceof Error ? {
+						message: err.message,
+						stack: err.stack
+					} : err });
+					reader.cancel("response write error");
+				};
+				response.once("error", onResError);
+				try {
+					while (true) {
+						const { done, value } = await reader.read();
+						if (done) break;
+						response.write(value);
+					}
+				} catch (error) {
+					this.mastra.getLogger()?.error("Error in datastream processing", { error: error instanceof Error ? {
+						message: error.message,
+						stack: error.stack
+					} : error });
+				} finally {
+					response.off("error", onResError);
+					response.end();
+				}
+			} else response.end();
+		} else if (route.responseType === "mcp-http") {
+			if (!request) {
+				response.status(500).json({ error: "Request object required for MCP transport" });
+				return;
+			}
+			const { server, httpPath, mcpOptions: routeMcpOptions } = result;
+			try {
+				const options = {
+					...this.mcpOptions,
+					...routeMcpOptions
+				};
+				await server.startHTTP({
+					url: new URL(request.url, `http://${request.headers.host}`),
+					httpPath: `${resolvedPrefix}${httpPath}`,
+					req: request,
+					res: response,
+					options: Object.keys(options).length > 0 ? options : void 0
+				});
+			} catch {
+				if (!response.headersSent) response.status(500).json({
+					jsonrpc: "2.0",
+					error: {
+						code: -32603,
+						message: "Internal server error"
+					},
+					id: null
+				});
+			}
+		} else if (route.responseType === "mcp-sse") {
+			if (!request) {
+				response.status(500).json({ error: "Request object required for MCP transport" });
+				return;
+			}
+			const { server, ssePath, messagePath } = result;
+			try {
+				await server.startSSE({
+					url: new URL(request.url, `http://${request.headers.host}`),
+					ssePath: `${resolvedPrefix}${ssePath}`,
+					messagePath: `${resolvedPrefix}${messagePath}`,
+					req: request,
+					res: response
+				});
+			} catch {
+				if (!response.headersSent) response.status(500).json({ error: "Error handling MCP SSE request" });
+			}
+		} else response.sendStatus(500);
+	}
+	async registerRoute(app, route, { prefix: prefixParam } = {}) {
+		const prefix = prefixParam ?? this.prefix ?? "";
+		const shouldApplyBodyLimit = this.bodyLimitOptions && [
+			"POST",
+			"PUT",
+			"PATCH"
+		].includes(route.method.toUpperCase());
+		const maxSize = route.maxBodySize ?? this.bodyLimitOptions?.maxSize;
+		const middlewares = [];
+		if (shouldApplyBodyLimit && maxSize && this.bodyLimitOptions) {
+			const bodyLimitMiddleware = (req, res, next) => {
+				const contentLength = req.headers["content-length"];
+				if (contentLength && parseInt(contentLength, 10) > maxSize) try {
+					const errorResponse = this.bodyLimitOptions.onError({ error: "Request body too large" });
+					return res.status(413).json(errorResponse);
+				} catch {
+					return res.status(413).json({ error: "Request body too large" });
+				}
+				next();
+			};
+			middlewares.push(bodyLimitMiddleware);
+		}
+		app[route.method.toLowerCase()](`${prefix}${route.path}`, ...middlewares, async (req, res) => {
+			const authError = await this.checkRouteAuth(route, {
+				path: String(req.path || "/"),
+				method: String(req.method || "GET"),
+				getHeader: (name) => req.headers[name.toLowerCase()],
+				getQuery: (name) => req.query[name],
+				requestContext: res.locals.requestContext,
+				request: toWebRequest(req),
+				buildAuthorizeContext: () => toWebRequest(req)
+			});
+			if (authError) {
+				const authResult = authError;
+				if (authResult.headers) for (const [key, value] of Object.entries(authResult.headers)) res.setHeader(key, value);
+				if (authResult.error) return res.status(authResult.status).json({ error: authResult.error });
+			}
+			const params = await this.getParams(route, req);
+			if (params.bodyParseError) return res.status(400).json({
+				error: "Invalid request body",
+				issues: [{
+					field: "body",
+					message: params.bodyParseError.message
+				}]
+			});
+			if (params.queryParams) try {
+				params.queryParams = await this.parseQueryParams(route, params.queryParams);
+			} catch (error) {
+				this.mastra.getLogger()?.error("Error parsing query params", { error: error instanceof Error ? {
+					message: error.message,
+					stack: error.stack
+				} : error });
+				if (isZodError(error)) {
+					const { status, body } = this.resolveValidationError(route, error, "query");
+					return res.status(status).json(body);
+				}
+				return res.status(400).json({
+					error: "Invalid query parameters",
+					issues: [{
+						field: "unknown",
+						message: error instanceof Error ? error.message : "Unknown error"
+					}]
+				});
+			}
+			if (params.body) try {
+				params.body = await this.parseBody(route, params.body);
+			} catch (error) {
+				this.mastra.getLogger()?.error("Error parsing body", { error: error instanceof Error ? {
+					message: error.message,
+					stack: error.stack
+				} : error });
+				if (isZodError(error)) {
+					const { status, body } = this.resolveValidationError(route, error, "body");
+					return res.status(status).json(body);
+				}
+				return res.status(400).json({
+					error: "Invalid request body",
+					issues: [{
+						field: "unknown",
+						message: error instanceof Error ? error.message : "Unknown error"
+					}]
+				});
+			}
+			if (params.urlParams) try {
+				params.urlParams = await this.parsePathParams(route, params.urlParams);
+			} catch (error) {
+				this.mastra.getLogger()?.error("Error parsing path params", { error: error instanceof Error ? {
+					message: error.message,
+					stack: error.stack
+				} : error });
+				if (isZodError(error)) {
+					const { status, body } = this.resolveValidationError(route, error, "path");
+					return res.status(status).json(body);
+				}
+				return res.status(400).json({
+					error: "Invalid path parameters",
+					issues: [{
+						field: "unknown",
+						message: error instanceof Error ? error.message : "Unknown error"
+					}]
+				});
+			}
+			const handlerParams = {
+				...params.urlParams,
+				...params.queryParams,
+				...typeof params.body === "object" ? params.body : {},
+				requestContext: res.locals.requestContext,
+				mastra: this.mastra,
+				registeredTools: res.locals.registeredTools,
+				taskStore: res.locals.taskStore,
+				abortSignal: res.locals.abortSignal,
+				routePrefix: prefix,
+				request: toWebRequest(req)
+			};
+			if (this.mastra.getServer()?.auth) {
+				const hasPermission = await loadHasPermission();
+				if (hasPermission) {
+					const userPermissions = res.locals.requestContext.get("mastra__userPermissions");
+					const permissionError = this.checkRoutePermission(route, userPermissions, hasPermission);
+					if (permissionError) return res.status(permissionError.status).json({
+						error: permissionError.error,
+						message: permissionError.message
+					});
+				}
+			}
+			const fgaError = await checkRouteFGA(this.mastra, route, res.locals.requestContext, {
+				...params.urlParams,
+				...params.queryParams,
+				...typeof params.body === "object" ? params.body : {}
+			});
+			if (fgaError) return res.status(fgaError.status).json({
+				error: fgaError.error,
+				message: fgaError.message
+			});
+			try {
+				const result = await route.handler(handlerParams);
+				await this.sendResponse(route, res, result, req, prefix);
+			} catch (error) {
+				const httpStatus = error && typeof error === "object" && "status" in error ? error.status : void 0;
+				if (!(typeof httpStatus === "number" && httpStatus >= 400 && httpStatus < 500)) this.mastra.getLogger()?.error("Error calling handler", {
+					error: error instanceof Error ? {
+						message: error.message,
+						stack: error.stack
+					} : error,
+					path: route.path,
+					method: route.method
+				});
+				let status = 500;
+				if (error && typeof error === "object") {
+					if ("status" in error) status = error.status;
+					else if ("details" in error && error.details && typeof error.details === "object" && "status" in error.details) status = error.details.status;
+				}
+				res.status(status).json({ error: error instanceof Error ? error.message : "Unknown error" });
+			}
+		});
+	}
+	async registerCustomApiRoutes() {
+		if (!await this.buildCustomRouteHandler()) return;
+		this.app.use(async (req, res, next) => {
+			const path = String(req.path || "/");
+			const method = String(req.method || "GET");
+			const matchedRoute = findMatchingCustomRoute(path, method, this.customApiRoutes ?? this.mastra.getServer()?.apiRoutes);
+			const shouldRunCustomRouteAuth = isProtectedCustomRoute(path, method, this.customRouteAuthConfig);
+			const shouldRunCustomRouteFGA = !!matchedRoute?.route.fga;
+			if (shouldRunCustomRouteAuth || shouldRunCustomRouteFGA) {
+				const serverRoute = {
+					method: matchedRoute?.route.method ?? method,
+					path: matchedRoute?.route.path ?? path,
+					responseType: "json",
+					handler: async () => {},
+					requiresAuth: matchedRoute?.route.requiresAuth,
+					requiresPermission: matchedRoute?.route.requiresPermission,
+					fga: matchedRoute?.route.fga
+				};
+				if (shouldRunCustomRouteAuth) {
+					const authError = await this.checkRouteAuth(serverRoute, {
+						path,
+						method,
+						getHeader: (name) => req.headers[name.toLowerCase()],
+						getQuery: (name) => req.query[name],
+						requestContext: res.locals.requestContext,
+						request: toWebRequest(req),
+						buildAuthorizeContext: () => toWebRequest(req)
+					});
+					if (authError) {
+						const authResult = authError;
+						if (authResult.headers) for (const [key, value] of Object.entries(authResult.headers)) res.setHeader(key, value);
+						if (authResult.error) return res.status(authResult.status).json({ error: authResult.error });
+					}
+					if (this.mastra.getServer()?.auth) {
+						const hasPermission = await loadHasPermission();
+						if (hasPermission) {
+							const userPermissions = res.locals.requestContext.get("mastra__userPermissions");
+							const permissionError = this.checkRoutePermission(serverRoute, userPermissions, hasPermission);
+							if (permissionError) return res.status(permissionError.status).json({
+								error: permissionError.error,
+								message: permissionError.message
+							});
+						}
+					}
+				}
+				const fgaError = await checkRouteFGA(this.mastra, serverRoute, res.locals.requestContext, {
+					...matchedRoute?.params ?? {},
+					...req.query,
+					...typeof req.body === "object" && req.body !== null ? req.body : {}
+				});
+				if (fgaError) return res.status(fgaError.status).json({
+					error: fgaError.error,
+					message: fgaError.message
+				});
+			}
+			const response = await this.handleCustomRouteRequest(`${req.protocol}://${req.get("host") || "localhost"}${req.originalUrl}`, req.method, req.headers, req.body, res.locals.requestContext, res.locals.abortSignal);
+			if (!response) return next();
+			await this.writeCustomRouteResponse(response, res, res.locals.abortSignal);
+		});
+	}
+	registerContextMiddleware() {
+		this.app.use(this.createContextMiddleware());
+	}
+	registerAuthMiddleware() {}
+	registerHttpLoggingMiddleware() {
+		if (!this.httpLoggingConfig?.enabled) return;
+		this.app.use((req, res, next) => {
+			if (!this.shouldLogRequest(req.path)) return next();
+			const start = Date.now();
+			const method = req.method;
+			const path = req.path;
+			res.on("finish", () => {
+				const duration = Date.now() - start;
+				const status = res.statusCode;
+				const level = this.httpLoggingConfig?.level || "info";
+				const logData = {
+					method,
+					path,
+					status,
+					duration: `${duration}ms`
+				};
+				if (this.httpLoggingConfig?.includeQueryParams) logData.query = req.query;
+				if (this.httpLoggingConfig?.includeHeaders) {
+					const headers = { ...req.headers };
+					(this.httpLoggingConfig.redactHeaders || []).forEach((h) => {
+						const key = h.toLowerCase();
+						if (headers[key] !== void 0) headers[key] = "[REDACTED]";
+					});
+					logData.headers = headers;
+				}
+				this.logger[level](`${method} ${path} ${status} ${duration}ms`, logData);
+			});
+			next();
+		});
+	}
 };
-
+//#endregion
 export { MastraServer, createAuthMiddleware };
-//# sourceMappingURL=index.js.map
+
 //# sourceMappingURL=index.js.map