@mastra/nestjs 0.2.30-alpha.0 → 0.2.30-alpha.1

package/dist/controllers/mastra.controller.d.ts

@@ -1,5 +1,7 @@
 import type { Request, Response } from 'express';
 import type { MastraModuleOptions } from '../mastra.module.js';
+import { AuthService } from '../services/auth.service.js';
+import { CustomRouteService } from '../services/custom-route.service.js';
 import { RequestContextService } from '../services/request-context.service.js';
 import { RouteHandlerService } from '../services/route-handler.service.js';
 /**
@@ -13,11 +15,13 @@ export declare class MastraController {
     private readonly options;
     private readonly routeHandler;
     private readonly requestContext;
-    constructor(options: MastraModuleOptions, routeHandler: RouteHandlerService, requestContext: RequestContextService);
+    private readonly customRoutes;
+    private readonly authService;
+    constructor(options: MastraModuleOptions, routeHandler: RouteHandlerService, requestContext: RequestContextService, customRoutes: CustomRouteService, authService: AuthService);
     /**
      * Catch-all handler that matches incoming requests to Mastra routes.
      */
-    handleRequest(req: Request, _res: Response): Promise<unknown>;
+    handleRequest(req: Request, res: Response): Promise<unknown>;
     /**
      * Parse and normalize query parameters.
      *

package/dist/controllers/mastra.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mastra.controller.d.ts","sourceRoot":"","sources":["../../src/controllers/mastra.controller.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAQjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE;;;;;;GAMG;AACH,qBAIa,gBAAgB;IAED,OAAO,CAAC,QAAQ,CAAC,OAAO;IACnB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAHhE,YAC2C,OAAO,EAAE,mBAAmB,EACvB,YAAY,EAAE,mBAAmB,EAC/B,cAAc,EAAE,qBAAqB,EACnF;IAEJ;;OAEG;IAEG,aAAa,CAAQ,GAAG,EAAE,OAAO,EAA8B,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAkCrG;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;OAEG;YACW,SAAS;CAsBxB"}
+{"version":3,"file":"mastra.controller.d.ts","sourceRoot":"","sources":["../../src/controllers/mastra.controller.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAQjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE;;;;;;GAMG;AACH,qBAIa,gBAAgB;IAED,OAAO,CAAC,QAAQ,CAAC,OAAO;IACnB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW;IALnD,YAC2C,OAAO,EAAE,mBAAmB,EACvB,YAAY,EAAE,mBAAmB,EAC/B,cAAc,EAAE,qBAAqB,EACxC,YAAY,EAAE,kBAAkB,EACvC,WAAW,EAAE,WAAW,EAC5D;IAEJ;;OAEG;IAEG,aAAa,CAAQ,GAAG,EAAE,OAAO,EAA8B,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAmDpG;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;OAEG;YACW,SAAS;CAsBxB"}

package/dist/guards/mastra-auth.guard.d.ts

@@ -7,15 +7,9 @@ import { AuthService } from '../services/auth.service.js';
  *
  * **IMPORTANT: This guard is for custom user routes, NOT for Mastra API routes.**
  *
- * Mastra routes (agents, workflows, etc.) use AuthService internally which has
- * access to route-specific auth configuration (customRouteAuthConfig, isProtectedPath,
- * canAccessPublicly). This guard is a simplified version for when you want to
- * protect your own NestJS routes with Mastra's auth config.
- *
- * Differences from AuthService (used internally for Mastra routes):
- * - Does NOT check `customRouteAuthConfig`
- * - Does NOT check `isProtectedPath` / `canAccessPublicly` from @mastra/server/auth
- * - Has simpler dev playground detection (just checks header + config)
+ * Mastra routes (agents, workflows, etc.) and `server.apiRoutes` are protected by
+ * MastraRouteGuard. Use this guard to protect your own NestJS routes with the
+ * same Mastra auth pipeline (`server.auth`).
  *
  * @example
  * ```typescript

package/dist/guards/mastra-auth.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mastra-auth.guard.d.ts","sourceRoot":"","sources":["../../src/guards/mastra-auth.guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAIzC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBACa,eAAgB,YAAW,WAAW;IAI5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAJnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAE3D,YACsC,SAAS,EAAE,SAAS,EAClB,WAAW,EAAE,WAAW,EAC5D;IAEE,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAmB7D;CACF"}
+{"version":3,"file":"mastra-auth.guard.d.ts","sourceRoot":"","sources":["../../src/guards/mastra-auth.guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAIzC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBACa,eAAgB,YAAW,WAAW;IAI5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAJnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAE3D,YACsC,SAAS,EAAE,SAAS,EAClB,WAAW,EAAE,WAAW,EAC5D;IAEE,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAqB7D;CACF"}

package/dist/guards/mastra-route.guard.d.ts

@@ -1,4 +1,3 @@
-import type { Mastra } from '@mastra/core/mastra';
 import type { CanActivate, ExecutionContext } from '@nestjs/common';
 import type { MastraModuleOptions } from '../mastra.module.js';
 import { AuthService } from '../services/auth.service.js';
@@ -11,13 +10,12 @@ import { MastraThrottleGuard } from './mastra-throttle.guard.js';
  * then enforces auth + rate limiting for matched Mastra routes.
  */
 export declare class MastraRouteGuard implements CanActivate {
-    private readonly mastra;
     private readonly options;
     private readonly routeHandler;
     private readonly requestContext;
     private readonly authService;
     private readonly throttleGuard;
-    constructor(mastra: Mastra, options: MastraModuleOptions, routeHandler: RouteHandlerService, requestContext: RequestContextService, authService: AuthService, throttleGuard: MastraThrottleGuard);
+    constructor(options: MastraModuleOptions, routeHandler: RouteHandlerService, requestContext: RequestContextService, authService: AuthService, throttleGuard: MastraThrottleGuard);
     canActivate(context: ExecutionContext): Promise<boolean>;
 }
 //# sourceMappingURL=mastra-route.guard.d.ts.map

package/dist/guards/mastra-route.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mastra-route.guard.d.ts","sourceRoot":"","sources":["../../src/guards/mastra-route.guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAIpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D;;;;GAIG;AACH,qBACa,gBAAiB,YAAW,WAAW;IAEhC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACf,OAAO,CAAC,QAAQ,CAAC,OAAO;IACnB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW;IACpB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAN7D,YACmC,MAAM,EAAE,MAAM,EACN,OAAO,EAAE,mBAAmB,EACvB,YAAY,EAAE,mBAAmB,EAC/B,cAAc,EAAE,qBAAqB,EAC/C,WAAW,EAAE,WAAW,EAChB,aAAa,EAAE,mBAAmB,EAC9E;IAEE,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CA+B7D;CACF"}
+{"version":3,"file":"mastra-route.guard.d.ts","sourceRoot":"","sources":["../../src/guards/mastra-route.guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAIpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D;;;;GAIG;AACH,qBACa,gBAAiB,YAAW,WAAW;IAExB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACnB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW;IACpB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAL7D,YAC2C,OAAO,EAAE,mBAAmB,EACvB,YAAY,EAAE,mBAAmB,EAC/B,cAAc,EAAE,qBAAqB,EAC/C,WAAW,EAAE,WAAW,EAChB,aAAa,EAAE,mBAAmB,EAC9E;IAEE,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CA6B7D;CACF"}

package/dist/index.cjs

@@ -25,8 +25,10 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 let _nestjs_common = require("@nestjs/common");
 let _mastra_server_server_adapter = require("@mastra/server/server-adapter");
 let _mastra_server_handlers_error = require("@mastra/server/handlers/error");
-let _mastra_server_auth = require("@mastra/server/auth");
 let _mastra_core_request_context = require("@mastra/core/request-context");
+let _mastra_server_auth = require("@mastra/server/auth");
+let stream = require("stream");
+let hono = require("hono");
 let _nestjs_core = require("@nestjs/core");
 let crypto = require("crypto");
 let module$1 = require("module");
@@ -473,82 +475,224 @@ function toWebRequest(req) {
 	});
 }
 //#endregion
-//#region src/services/auth.service.ts
-var _AuthService;
-let AuthService = _AuthService = class AuthService {
+//#region src/services/custom-route.service.ts
+const NOT_FOUND_HEADER = "x-mastra-custom-route-not-found";
+let CustomRouteService = class CustomRouteService {
 	mastra;
-	options;
-	logger = new _nestjs_common.Logger(_AuthService.name);
+	routes;
+	authConfig;
+	fetchPromise;
 	constructor(mastra, options) {
 		this.mastra = mastra;
-		this.options = options;
+		this.routes = (mastra.getServer()?.apiRoutes ?? []).filter((route) => !("_mastraSchemaRoute" in route && route._mastraSchemaRoute === true));
+		this.authConfig = new Map(options.customRouteAuthConfig);
+		for (const route of this.routes) {
+			const key = `${route.method}:${route.path}`;
+			if (!this.authConfig.has(key)) this.authConfig.set(key, route.requiresAuth !== false);
+		}
+	}
+	/** Auth config for custom routes, keyed by `METHOD:path`. */
+	get customRouteAuthConfig() {
+		return this.authConfig;
 	}
 	/**
-	* Check authentication for a request based on the matched route.
-	* Returns the authenticated user if auth succeeds, undefined if no auth required.
-	* Throws UnauthorizedException or ForbiddenException if auth fails.
+	* Runs a matched custom route and writes its response.
+	* Returns false if no custom route handled the request.
 	*
-	* Type assertions (`as any`) are used because `@mastra/server/auth` types
-	* are Hono-centric. The runtime values work with Express requests.
+	* `authenticate` runs after Hono's router selects the route, so auth is enforced
+	* for exactly the routes Hono dispatches (including regex-constrained params).
 	*/
-	async authenticate(request) {
-		const authConfig = this.mastra.getServer()?.auth;
-		const customRouteAuthConfig = this.options.customRouteAuthConfig;
-		const method = request.method;
-		const path = request.path;
-		if (!authConfig) return;
-		const helperAuthConfig = authConfig;
-		const getHeader = (name) => {
-			const value = request.headers[name.toLowerCase()];
-			return Array.isArray(value) ? value[0] : value;
-		};
-		if ((0, _mastra_server_auth.isDevPlaygroundRequest)(path, method, getHeader, helperAuthConfig, customRouteAuthConfig)) return;
-		if (!(0, _mastra_server_auth.isProtectedPath)(path, method, helperAuthConfig, customRouteAuthConfig)) return;
-		if ((0, _mastra_server_auth.canAccessPublicly)(path, method, helperAuthConfig)) return;
-		const token = this.extractToken(request);
-		if (!token) throw new _nestjs_common.UnauthorizedException("Authentication required");
+	async handle(req, res, requestContext, authenticate) {
+		if (this.routes.length === 0) return false;
+		this.fetchPromise ??= this.build().catch((err) => {
+			this.fetchPromise = void 0;
+			throw err;
+		});
+		const fetch = await this.fetchPromise;
+		const env = {
+			requestContext,
+			authenticate
+		};
+		const response = await fetch(this.toFetchRequest(req), env);
+		if (env.authError !== void 0) throw env.authError;
+		if (response.headers.get(NOT_FOUND_HEADER) === "true") return false;
+		res.status(response.status);
+		response.headers.forEach((value, key) => {
+			if (key.toLowerCase() === "set-cookie") return;
+			res.setHeader(key, value);
+		});
+		for (const cookie of response.headers.getSetCookie()) res.append("set-cookie", cookie);
+		if (!response.body) {
+			res.end();
+			return true;
+		}
+		const reader = response.body.getReader();
+		const onClose = () => void reader.cancel().catch(() => {});
+		res.once("close", onClose);
 		try {
-			let user;
-			if (typeof authConfig?.authenticateToken === "function") user = await authConfig.authenticateToken(token, toWebRequest(request));
-			else throw new Error("No token verification method configured");
-			if (!user) throw new _nestjs_common.UnauthorizedException("Invalid or expired token");
-			request.user = user;
-			await this.authorize(request, path, method, user, authConfig);
-			return user;
-		} catch (error) {
-			if (error instanceof _nestjs_common.UnauthorizedException || error instanceof _nestjs_common.ForbiddenException) throw error;
-			this.logger.error("Authentication error:", error instanceof Error ? error.message : "Unknown error");
-			throw new _nestjs_common.UnauthorizedException("Authentication failed");
+			while (!res.destroyed) {
+				const { done, value } = await reader.read();
+				if (done) break;
+				if (!res.write(value)) await new Promise((resolve) => {
+					const resume = () => {
+						res.off("drain", resume);
+						res.off("close", resume);
+						resolve();
+					};
+					res.once("drain", resume);
+					res.once("close", resume);
+				});
+			}
+		} finally {
+			res.off("close", onClose);
+			res.end();
 		}
+		return true;
+	}
+	async build() {
+		const mastra = this.mastra;
+		const app = new hono.Hono();
+		app.use("*", async (c, next) => {
+			c.set("mastra", mastra);
+			c.set("requestContext", c.env?.requestContext ?? new _mastra_core_request_context.RequestContext());
+			await next();
+		});
+		const serverOnError = mastra.getServer()?.onError;
+		app.onError((err, c) => {
+			if (serverOnError) return serverOnError(err, c);
+			mastra.getLogger()?.error(`Custom route handler failed: ${c.req.method} ${c.req.path}`, { error: err instanceof Error ? err.stack ?? err.message : String(err) });
+			return c.json({ error: "Internal Server Error" }, 500);
+		});
+		for (const route of this.routes) {
+			const handler = "handler" in route && route.handler ? route.handler : "createHandler" in route ? await route.createHandler({ mastra }) : void 0;
+			if (!handler) continue;
+			const middlewares = route.middleware ? Array.isArray(route.middleware) ? route.middleware : [route.middleware] : [];
+			const requiresAuth = this.authConfig.get(`${route.method}:${route.path}`) ?? route.requiresAuth !== false;
+			const authMiddleware = async (c, next) => {
+				try {
+					await c.env.authenticate(requiresAuth);
+				} catch (err) {
+					c.env.authError = err;
+					return c.body(null, 401);
+				}
+				await next();
+			};
+			const handlers = [
+				authMiddleware,
+				...middlewares,
+				handler
+			];
+			if (route.method === "ALL") app.all(route.path, handlers[0], ...handlers.slice(1));
+			else app.on(route.method, route.path, handlers[0], ...handlers.slice(1));
+		}
+		app.notFound(() => new Response(null, {
+			status: 404,
+			headers: { [NOT_FOUND_HEADER]: "true" }
+		}));
+		return (request, env) => Promise.resolve(app.fetch(request, env));
+	}
+	toFetchRequest(req) {
+		const url = `${req.protocol || "http"}://${req.get("host") || "localhost"}${req.originalUrl || req.url}`;
+		const headers = new Headers();
+		for (const [key, value] of Object.entries(req.headers)) if (typeof value === "string") headers.set(key, value);
+		else if (Array.isArray(value)) value.forEach((v) => headers.append(key, v));
+		const init = {
+			method: req.method,
+			headers
+		};
+		if (["GET", "HEAD"].includes(req.method)) return new globalThis.Request(url, init);
+		const body = req.body;
+		if (!(req._body === true) && req.readable && !req.readableEnded) {
+			init.body = stream.Readable.toWeb(req);
+			init.duplex = "half";
+		} else if (typeof body === "string" || body instanceof Uint8Array) init.body = body;
+		else if (typeof body === "object" && body !== null) {
+			const contentType = headers.get("content-type") ?? "";
+			if (contentType.includes("application/x-www-form-urlencoded")) init.body = new URLSearchParams(body).toString();
+			else {
+				init.body = JSON.stringify(body);
+				if (!contentType) headers.set("content-type", "application/json");
+			}
+			headers.delete("content-length");
+		}
+		return new globalThis.Request(url, init);
+	}
+};
+CustomRouteService = __decorate([
+	(0, _nestjs_common.Injectable)(),
+	__decorateParam(0, (0, _nestjs_common.Inject)(MASTRA)),
+	__decorateParam(1, (0, _nestjs_common.Inject)(MASTRA_OPTIONS)),
+	__decorateMetadata("design:paramtypes", [Object, Object])
+], CustomRouteService);
+//#endregion
+//#region src/services/auth.service.ts
+let AuthService = class AuthService {
+	mastra;
+	options;
+	customRoutes;
+	constructor(mastra, options, customRoutes) {
+		this.mastra = mastra;
+		this.options = options;
+		this.customRoutes = customRoutes;
 	}
 	/**
-	* Check authorization for an authenticated user.
-	* `authConfig` is typed as `any` because `@mastra/server/auth` doesn't
-	* export a standalone type for the auth config object.
+	* Whether Mastra auth should run: module options enable it, or the Mastra
+	* server has auth configured (unless module options explicitly disable it).
 	*/
-	async authorize(request, path, method, user, authConfig) {
-		if (typeof authConfig.authorizeUser === "function") {
-			if (!await authConfig.authorizeUser(user, toWebRequest(request))) throw new _nestjs_common.ForbiddenException("Access denied");
-			return;
-		}
-		if (typeof authConfig.authorize === "function") {
-			const context = {
+	isEnabled() {
+		if (this.options.auth?.enabled === false) return false;
+		return Boolean(this.options.auth?.enabled || this.mastra.getServer()?.auth);
+	}
+	/**
+	* Check authentication for a request.
+	* Returns the authenticated user if auth succeeds, undefined if no auth required.
+	* Throws UnauthorizedException or ForbiddenException if auth fails.
+	*/
+	async authenticate(request, options = {}) {
+		const authConfig = this.mastra.getServer()?.auth;
+		if (!authConfig) return;
+		const requestContext = options.requestContext ?? new _mastra_core_request_context.RequestContext();
+		const path = request.path;
+		const method = request.method;
+		let customRouteAuthConfig = this.customRoutes.customRouteAuthConfig;
+		if (options.customRoute && options.requiresAuth !== void 0) {
+			customRouteAuthConfig = new Map(customRouteAuthConfig);
+			customRouteAuthConfig.set(`${method.toUpperCase()}:${path}`, options.requiresAuth);
+		}
+		const webRequest = toWebRequest(request);
+		const result = await (0, _mastra_server_auth.coreAuthMiddleware)({
+			path,
+			method,
+			getHeader: (name) => {
+				const value = request.headers[name.toLowerCase()];
+				return Array.isArray(value) ? value[0] : value;
+			},
+			mastra: this.mastra,
+			authConfig,
+			customRouteAuthConfig,
+			requestContext,
+			rawRequest: webRequest,
+			token: this.extractToken(request) ?? null,
+			buildAuthorizeContext: () => ({
 				get: (key) => {
 					if (key === "mastra") return this.mastra;
-					if (key === "customRouteAuthConfig") return this.options.customRouteAuthConfig;
+					if (key === "customRouteAuthConfig") return customRouteAuthConfig;
 				},
-				req: toWebRequest(request)
-			};
-			if (!await authConfig.authorize(path, method, user, context)) throw new _nestjs_common.ForbiddenException("Access denied");
-			return;
-		}
-		if ("rules" in authConfig && authConfig.rules && authConfig.rules.length > 0) {
-			if (!await (0, _mastra_server_auth.checkRules)(authConfig.rules, path, method, user)) throw new _nestjs_common.ForbiddenException("Access denied");
-			return;
-		}
-		if (_mastra_server_auth.defaultAuthConfig.rules && _mastra_server_auth.defaultAuthConfig.rules.length > 0) {
-			if (!await (0, _mastra_server_auth.checkRules)(_mastra_server_auth.defaultAuthConfig.rules, path, method, user)) throw new _nestjs_common.ForbiddenException("Access denied");
-		}
+				req: webRequest
+			}),
+			requiresAuth: options.requiresAuth
+		});
+		if (result.headers && options.response) for (const [key, value] of Object.entries(result.headers)) if (key.toLowerCase() === "set-cookie") options.response.append(key, value);
+		else options.response.setHeader(key, value);
+		if (result.action === "error") {
+			const message = typeof result.body.error === "string" ? result.body.error : "Access denied";
+			if (result.status === 401) throw new _nestjs_common.UnauthorizedException(message);
+			if (result.status === 403) throw new _nestjs_common.ForbiddenException(message);
+			throw new _nestjs_common.HttpException(result.body, result.status);
+		}
+		const user = requestContext.get(_mastra_server_auth.MASTRA_USER_KEY);
+		if (user !== void 0) request.user = user;
+		return user;
 	}
 	/**
 	* Extract authentication token from request.
@@ -567,11 +711,16 @@ let AuthService = _AuthService = class AuthService {
 		}
 	}
 };
-AuthService = _AuthService = __decorate([
+AuthService = __decorate([
 	(0, _nestjs_common.Injectable)(),
 	__decorateParam(0, (0, _nestjs_common.Inject)(MASTRA)),
 	__decorateParam(1, (0, _nestjs_common.Inject)(MASTRA_OPTIONS)),
-	__decorateMetadata("design:paramtypes", [Object, Object])
+	__decorateParam(2, (0, _nestjs_common.Inject)(CustomRouteService)),
+	__decorateMetadata("design:paramtypes", [
+		Object,
+		Object,
+		typeof CustomRouteService === "undefined" ? Object : CustomRouteService
+	])
 ], AuthService);
 //#endregion
 //#region src/services/request-context.service.ts
@@ -850,14 +999,12 @@ MastraThrottleGuard = _MastraThrottleGuard = __decorate([
 //#endregion
 //#region src/guards/mastra-route.guard.ts
 let MastraRouteGuard = class MastraRouteGuard {
-	mastra;
 	options;
 	routeHandler;
 	requestContext;
 	authService;
 	throttleGuard;
-	constructor(mastra, options, routeHandler, requestContext, authService, throttleGuard) {
-		this.mastra = mastra;
+	constructor(options, routeHandler, requestContext, authService, throttleGuard) {
 		this.options = options;
 		this.routeHandler = routeHandler;
 		this.requestContext = requestContext;
@@ -868,29 +1015,29 @@ let MastraRouteGuard = class MastraRouteGuard {
 		const request = context.switchToHttp().getRequest();
 		const method = request.method.toUpperCase();
 		const routePath = getMastraRoutePath(request.path, this.options.prefix);
-		if (!routePath) return true;
-		if (!this.routeHandler.matchRoute(method, routePath)) return true;
-		if (this.options.auth?.enabled !== false && (this.options.auth?.enabled || this.mastra.getServer()?.auth)) {
-			const user = await this.authService.authenticate(request);
+		if (!(routePath ? this.routeHandler.matchRoute(method, routePath) : void 0)) return true;
+		if (this.authService.isEnabled()) {
+			const user = await this.authService.authenticate(request, {
+				requestContext: this.requestContext.requestContext,
+				response: context.switchToHttp().getResponse()
+			});
 			if (user !== void 0) this.requestContext.setUser(user);
 		}
 		if (this.options.rateLimitOptions?.enabled !== false) {
-			const { limit, windowMs } = this.throttleGuard.getRateLimitSettings(request, void 0, routePath);
-			await this.throttleGuard.checkLimit(request, limit, windowMs, routePath);
+			const { limit, windowMs } = this.throttleGuard.getRateLimitSettings(request, void 0, routePath ?? void 0);
+			await this.throttleGuard.checkLimit(request, limit, windowMs, routePath ?? void 0);
 		}
 		return true;
 	}
 };
 MastraRouteGuard = __decorate([
 	(0, _nestjs_common.Injectable)({ scope: _nestjs_common.Scope.REQUEST }),
-	__decorateParam(0, (0, _nestjs_common.Inject)(MASTRA)),
-	__decorateParam(1, (0, _nestjs_common.Inject)(MASTRA_OPTIONS)),
-	__decorateParam(2, (0, _nestjs_common.Inject)(RouteHandlerService)),
-	__decorateParam(3, (0, _nestjs_common.Inject)(RequestContextService)),
-	__decorateParam(4, (0, _nestjs_common.Inject)(AuthService)),
-	__decorateParam(5, (0, _nestjs_common.Inject)(MastraThrottleGuard)),
+	__decorateParam(0, (0, _nestjs_common.Inject)(MASTRA_OPTIONS)),
+	__decorateParam(1, (0, _nestjs_common.Inject)(RouteHandlerService)),
+	__decorateParam(2, (0, _nestjs_common.Inject)(RequestContextService)),
+	__decorateParam(3, (0, _nestjs_common.Inject)(AuthService)),
+	__decorateParam(4, (0, _nestjs_common.Inject)(MastraThrottleGuard)),
 	__decorateMetadata("design:paramtypes", [
-		Object,
 		Object,
 		typeof RouteHandlerService === "undefined" ? Object : RouteHandlerService,
 		typeof RequestContextService === "undefined" ? Object : RequestContextService,
@@ -10853,18 +11000,36 @@ let MastraController = class MastraController {
 	options;
 	routeHandler;
 	requestContext;
-	constructor(options, routeHandler, requestContext) {
+	customRoutes;
+	authService;
+	constructor(options, routeHandler, requestContext, customRoutes, authService) {
 		this.options = options;
 		this.routeHandler = routeHandler;
 		this.requestContext = requestContext;
+		this.customRoutes = customRoutes;
+		this.authService = authService;
 	}
 	/**
 	* Catch-all handler that matches incoming requests to Mastra routes.
 	*/
-	async handleRequest(req, _res) {
+	async handleRequest(req, res) {
 		const path = req.path;
 		const method = req.method.toUpperCase();
 		const routePath = getMastraRoutePath(path, this.options.prefix);
+		if (!routePath || !this.routeHandler.matchRoute(method, routePath)) {
+			const requestContext = this.requestContext.requestContext;
+			const authenticate = async (requiresAuth) => {
+				if (!this.authService.isEnabled()) return;
+				const user = await this.authService.authenticate(req, {
+					requestContext,
+					response: res,
+					requiresAuth,
+					customRoute: true
+				});
+				if (user !== void 0) this.requestContext.setUser(user);
+			};
+			if (await this.customRoutes.handle(req, res, requestContext, authenticate)) return;
+		}
 		if (!routePath) throw new _nestjs_common.NotFoundException(`Route not found: ${method} ${path}`);
 		if (routePath.includes("//")) throw new _nestjs_common.NotFoundException(`Route not found: ${method} ${path}`);
 		const matchResult = this.routeHandler.matchRoute(method, routePath);
@@ -10943,10 +11108,14 @@ MastraController = __decorate([
 	__decorateParam(0, (0, _nestjs_common.Inject)(MASTRA_OPTIONS)),
 	__decorateParam(1, (0, _nestjs_common.Inject)(RouteHandlerService)),
 	__decorateParam(2, (0, _nestjs_common.Inject)(RequestContextService)),
+	__decorateParam(3, (0, _nestjs_common.Inject)(CustomRouteService)),
+	__decorateParam(4, (0, _nestjs_common.Inject)(AuthService)),
 	__decorateMetadata("design:paramtypes", [
 		Object,
 		typeof RouteHandlerService === "undefined" ? Object : RouteHandlerService,
-		typeof RequestContextService === "undefined" ? Object : RequestContextService
+		typeof RequestContextService === "undefined" ? Object : RequestContextService,
+		typeof CustomRouteService === "undefined" ? Object : CustomRouteService,
+		typeof AuthService === "undefined" ? Object : AuthService
 	])
 ], MastraController);
 //#endregion
@@ -11107,7 +11276,7 @@ let MastraAuthGuard = _MastraAuthGuard = class MastraAuthGuard {
 		if (this.reflector.getAllAndOverride("isPublic", [context.getHandler(), context.getClass()])) return true;
 		const request = context.switchToHttp().getRequest();
 		try {
-			await this.authService.authenticate(request);
+			await this.authService.authenticate(request, { response: context.switchToHttp().getResponse() });
 			return true;
 		} catch (error) {
 			this.logger.error(`Authentication error: ${error instanceof Error ? error.message : String(error)}`);
@@ -11321,6 +11490,7 @@ let MastraModule = _MastraModule = class MastraModule {
 				RequestContextService,
 				ShutdownService,
 				AuthService,
+				CustomRouteService,
 				BodyLimitMiddleware,
 				JsonBodyMiddleware,
 				MastraAuthGuard,
@@ -11395,6 +11565,7 @@ let MastraModule = _MastraModule = class MastraModule {
 				RequestContextService,
 				ShutdownService,
 				AuthService,
+				CustomRouteService,
 				BodyLimitMiddleware,
 				JsonBodyMiddleware,
 				MastraAuthGuard,
@@ -11433,6 +11604,12 @@ Object.defineProperty(exports, "BodyLimitMiddleware", {
 		return BodyLimitMiddleware;
 	}
 });
+Object.defineProperty(exports, "CustomRouteService", {
+	enumerable: true,
+	get: function() {
+		return CustomRouteService;
+	}
+});
 Object.defineProperty(exports, "JsonBodyMiddleware", {
 	enumerable: true,
 	get: function() {