@mastra/nestjs 0.2.30-alpha.0 → 0.2.30

package/dist/index.d.ts

@@ -15,6 +15,8 @@ export type { RouteHandlerParams, RouteHandlerResult, RouteMatch } from './servi
 export { RequestContextService } from './services/request-context.service.js';
 export { ShutdownService } from './services/shutdown.service.js';
 export { AuthService } from './services/auth.service.js';
+export type { AuthenticateOptions } from './services/auth.service.js';
+export { CustomRouteService } from './services/custom-route.service.js';
 export { BodyLimitMiddleware } from './middleware/body-limit.middleware.js';
 export { JsonBodyMiddleware } from './middleware/json-body.middleware.js';
 export { parseMultipartFormData } from './utils/parse-multipart.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAGjH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGrD,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGrG,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAGrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAG1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAGxE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACxF,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAC3G,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAGvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAGjH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGrD,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGrG,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAGrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAG1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAGxE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACxF,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAC3G,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,YAAY,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAGvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/index.js

@@ -2,8 +2,10 @@ import { createRequire } from "module";
 import { All, BadRequestException, Catch, Controller, ForbiddenException, Get, HttpException, HttpStatus, Inject, Injectable, Logger, Module, NotFoundException, PayloadTooLargeException, Req, Res, Scope, ServiceUnavailableException, SetMetadata, UnauthorizedException, UseFilters, UseGuards, UseInterceptors } from "@nestjs/common";
 import { HTTPException, MASTRA_CLIENT_TYPE_HEADER, MASTRA_IS_STUDIO_KEY, SERVER_ROUTES, getCustomHTTPExceptionResponse, isReservedRequestContextKey, isStudioClientTypeHeader, isZodError, normalizeQueryParams, redactStreamChunk, serializeStreamChunk } from "@mastra/server/server-adapter";
 import { formatZodError, isZodError as isZodError$1 } from "@mastra/server/handlers/error";
-import { canAccessPublicly, checkRules, defaultAuthConfig, isDevPlaygroundRequest, isProtectedPath } from "@mastra/server/auth";
 import { RequestContext } from "@mastra/core/request-context";
+import { MASTRA_USER_KEY, coreAuthMiddleware } from "@mastra/server/auth";
+import { Readable } from "stream";
+import { Hono } from "hono";
 import { HttpAdapterHost, REQUEST, Reflector } from "@nestjs/core";
 import { randomUUID } from "crypto";
 import { Busboy } from "@fastify/busboy";
@@ -451,82 +453,224 @@ function toWebRequest(req) {
 	});
 }
 //#endregion
-//#region src/services/auth.service.ts
-var _AuthService;
-let AuthService = _AuthService = class AuthService {
+//#region src/services/custom-route.service.ts
+const NOT_FOUND_HEADER = "x-mastra-custom-route-not-found";
+let CustomRouteService = class CustomRouteService {
 	mastra;
-	options;
-	logger = new Logger(_AuthService.name);
+	routes;
+	authConfig;
+	fetchPromise;
 	constructor(mastra, options) {
 		this.mastra = mastra;
-		this.options = options;
+		this.routes = (mastra.getServer()?.apiRoutes ?? []).filter((route) => !("_mastraSchemaRoute" in route && route._mastraSchemaRoute === true));
+		this.authConfig = new Map(options.customRouteAuthConfig);
+		for (const route of this.routes) {
+			const key = `${route.method}:${route.path}`;
+			if (!this.authConfig.has(key)) this.authConfig.set(key, route.requiresAuth !== false);
+		}
+	}
+	/** Auth config for custom routes, keyed by `METHOD:path`. */
+	get customRouteAuthConfig() {
+		return this.authConfig;
 	}
 	/**
-	* Check authentication for a request based on the matched route.
-	* Returns the authenticated user if auth succeeds, undefined if no auth required.
-	* Throws UnauthorizedException or ForbiddenException if auth fails.
+	* Runs a matched custom route and writes its response.
+	* Returns false if no custom route handled the request.
 	*
-	* Type assertions (`as any`) are used because `@mastra/server/auth` types
-	* are Hono-centric. The runtime values work with Express requests.
+	* `authenticate` runs after Hono's router selects the route, so auth is enforced
+	* for exactly the routes Hono dispatches (including regex-constrained params).
 	*/
-	async authenticate(request) {
-		const authConfig = this.mastra.getServer()?.auth;
-		const customRouteAuthConfig = this.options.customRouteAuthConfig;
-		const method = request.method;
-		const path = request.path;
-		if (!authConfig) return;
-		const helperAuthConfig = authConfig;
-		const getHeader = (name) => {
-			const value = request.headers[name.toLowerCase()];
-			return Array.isArray(value) ? value[0] : value;
-		};
-		if (isDevPlaygroundRequest(path, method, getHeader, helperAuthConfig, customRouteAuthConfig)) return;
-		if (!isProtectedPath(path, method, helperAuthConfig, customRouteAuthConfig)) return;
-		if (canAccessPublicly(path, method, helperAuthConfig)) return;
-		const token = this.extractToken(request);
-		if (!token) throw new UnauthorizedException("Authentication required");
+	async handle(req, res, requestContext, authenticate) {
+		if (this.routes.length === 0) return false;
+		this.fetchPromise ??= this.build().catch((err) => {
+			this.fetchPromise = void 0;
+			throw err;
+		});
+		const fetch = await this.fetchPromise;
+		const env = {
+			requestContext,
+			authenticate
+		};
+		const response = await fetch(this.toFetchRequest(req), env);
+		if (env.authError !== void 0) throw env.authError;
+		if (response.headers.get(NOT_FOUND_HEADER) === "true") return false;
+		res.status(response.status);
+		response.headers.forEach((value, key) => {
+			if (key.toLowerCase() === "set-cookie") return;
+			res.setHeader(key, value);
+		});
+		for (const cookie of response.headers.getSetCookie()) res.append("set-cookie", cookie);
+		if (!response.body) {
+			res.end();
+			return true;
+		}
+		const reader = response.body.getReader();
+		const onClose = () => void reader.cancel().catch(() => {});
+		res.once("close", onClose);
 		try {
-			let user;
-			if (typeof authConfig?.authenticateToken === "function") user = await authConfig.authenticateToken(token, toWebRequest(request));
-			else throw new Error("No token verification method configured");
-			if (!user) throw new UnauthorizedException("Invalid or expired token");
-			request.user = user;
-			await this.authorize(request, path, method, user, authConfig);
-			return user;
-		} catch (error) {
-			if (error instanceof UnauthorizedException || error instanceof ForbiddenException) throw error;
-			this.logger.error("Authentication error:", error instanceof Error ? error.message : "Unknown error");
-			throw new UnauthorizedException("Authentication failed");
+			while (!res.destroyed) {
+				const { done, value } = await reader.read();
+				if (done) break;
+				if (!res.write(value)) await new Promise((resolve) => {
+					const resume = () => {
+						res.off("drain", resume);
+						res.off("close", resume);
+						resolve();
+					};
+					res.once("drain", resume);
+					res.once("close", resume);
+				});
+			}
+		} finally {
+			res.off("close", onClose);
+			res.end();
+		}
+		return true;
+	}
+	async build() {
+		const mastra = this.mastra;
+		const app = new Hono();
+		app.use("*", async (c, next) => {
+			c.set("mastra", mastra);
+			c.set("requestContext", c.env?.requestContext ?? new RequestContext());
+			await next();
+		});
+		const serverOnError = mastra.getServer()?.onError;
+		app.onError((err, c) => {
+			if (serverOnError) return serverOnError(err, c);
+			mastra.getLogger()?.error(`Custom route handler failed: ${c.req.method} ${c.req.path}`, { error: err instanceof Error ? err.stack ?? err.message : String(err) });
+			return c.json({ error: "Internal Server Error" }, 500);
+		});
+		for (const route of this.routes) {
+			const handler = "handler" in route && route.handler ? route.handler : "createHandler" in route ? await route.createHandler({ mastra }) : void 0;
+			if (!handler) continue;
+			const middlewares = route.middleware ? Array.isArray(route.middleware) ? route.middleware : [route.middleware] : [];
+			const requiresAuth = this.authConfig.get(`${route.method}:${route.path}`) ?? route.requiresAuth !== false;
+			const authMiddleware = async (c, next) => {
+				try {
+					await c.env.authenticate(requiresAuth);
+				} catch (err) {
+					c.env.authError = err;
+					return c.body(null, 401);
+				}
+				await next();
+			};
+			const handlers = [
+				authMiddleware,
+				...middlewares,
+				handler
+			];
+			if (route.method === "ALL") app.all(route.path, handlers[0], ...handlers.slice(1));
+			else app.on(route.method, route.path, handlers[0], ...handlers.slice(1));
+		}
+		app.notFound(() => new Response(null, {
+			status: 404,
+			headers: { [NOT_FOUND_HEADER]: "true" }
+		}));
+		return (request, env) => Promise.resolve(app.fetch(request, env));
+	}
+	toFetchRequest(req) {
+		const url = `${req.protocol || "http"}://${req.get("host") || "localhost"}${req.originalUrl || req.url}`;
+		const headers = new Headers();
+		for (const [key, value] of Object.entries(req.headers)) if (typeof value === "string") headers.set(key, value);
+		else if (Array.isArray(value)) value.forEach((v) => headers.append(key, v));
+		const init = {
+			method: req.method,
+			headers
+		};
+		if (["GET", "HEAD"].includes(req.method)) return new globalThis.Request(url, init);
+		const body = req.body;
+		if (!(req._body === true) && req.readable && !req.readableEnded) {
+			init.body = Readable.toWeb(req);
+			init.duplex = "half";
+		} else if (typeof body === "string" || body instanceof Uint8Array) init.body = body;
+		else if (typeof body === "object" && body !== null) {
+			const contentType = headers.get("content-type") ?? "";
+			if (contentType.includes("application/x-www-form-urlencoded")) init.body = new URLSearchParams(body).toString();
+			else {
+				init.body = JSON.stringify(body);
+				if (!contentType) headers.set("content-type", "application/json");
+			}
+			headers.delete("content-length");
 		}
+		return new globalThis.Request(url, init);
+	}
+};
+CustomRouteService = __decorate([
+	Injectable(),
+	__decorateParam(0, Inject(MASTRA)),
+	__decorateParam(1, Inject(MASTRA_OPTIONS)),
+	__decorateMetadata("design:paramtypes", [Object, Object])
+], CustomRouteService);
+//#endregion
+//#region src/services/auth.service.ts
+let AuthService = class AuthService {
+	mastra;
+	options;
+	customRoutes;
+	constructor(mastra, options, customRoutes) {
+		this.mastra = mastra;
+		this.options = options;
+		this.customRoutes = customRoutes;
 	}
 	/**
-	* Check authorization for an authenticated user.
-	* `authConfig` is typed as `any` because `@mastra/server/auth` doesn't
-	* export a standalone type for the auth config object.
+	* Whether Mastra auth should run: module options enable it, or the Mastra
+	* server has auth configured (unless module options explicitly disable it).
 	*/
-	async authorize(request, path, method, user, authConfig) {
-		if (typeof authConfig.authorizeUser === "function") {
-			if (!await authConfig.authorizeUser(user, toWebRequest(request))) throw new ForbiddenException("Access denied");
-			return;
-		}
-		if (typeof authConfig.authorize === "function") {
-			const context = {
+	isEnabled() {
+		if (this.options.auth?.enabled === false) return false;
+		return Boolean(this.options.auth?.enabled || this.mastra.getServer()?.auth);
+	}
+	/**
+	* Check authentication for a request.
+	* Returns the authenticated user if auth succeeds, undefined if no auth required.
+	* Throws UnauthorizedException or ForbiddenException if auth fails.
+	*/
+	async authenticate(request, options = {}) {
+		const authConfig = this.mastra.getServer()?.auth;
+		if (!authConfig) return;
+		const requestContext = options.requestContext ?? new RequestContext();
+		const path = request.path;
+		const method = request.method;
+		let customRouteAuthConfig = this.customRoutes.customRouteAuthConfig;
+		if (options.customRoute && options.requiresAuth !== void 0) {
+			customRouteAuthConfig = new Map(customRouteAuthConfig);
+			customRouteAuthConfig.set(`${method.toUpperCase()}:${path}`, options.requiresAuth);
+		}
+		const webRequest = toWebRequest(request);
+		const result = await coreAuthMiddleware({
+			path,
+			method,
+			getHeader: (name) => {
+				const value = request.headers[name.toLowerCase()];
+				return Array.isArray(value) ? value[0] : value;
+			},
+			mastra: this.mastra,
+			authConfig,
+			customRouteAuthConfig,
+			requestContext,
+			rawRequest: webRequest,
+			token: this.extractToken(request) ?? null,
+			buildAuthorizeContext: () => ({
 				get: (key) => {
 					if (key === "mastra") return this.mastra;
-					if (key === "customRouteAuthConfig") return this.options.customRouteAuthConfig;
+					if (key === "customRouteAuthConfig") return customRouteAuthConfig;
 				},
-				req: toWebRequest(request)
-			};
-			if (!await authConfig.authorize(path, method, user, context)) throw new ForbiddenException("Access denied");
-			return;
-		}
-		if ("rules" in authConfig && authConfig.rules && authConfig.rules.length > 0) {
-			if (!await checkRules(authConfig.rules, path, method, user)) throw new ForbiddenException("Access denied");
-			return;
-		}
-		if (defaultAuthConfig.rules && defaultAuthConfig.rules.length > 0) {
-			if (!await checkRules(defaultAuthConfig.rules, path, method, user)) throw new ForbiddenException("Access denied");
-		}
+				req: webRequest
+			}),
+			requiresAuth: options.requiresAuth
+		});
+		if (result.headers && options.response) for (const [key, value] of Object.entries(result.headers)) if (key.toLowerCase() === "set-cookie") options.response.append(key, value);
+		else options.response.setHeader(key, value);
+		if (result.action === "error") {
+			const message = typeof result.body.error === "string" ? result.body.error : "Access denied";
+			if (result.status === 401) throw new UnauthorizedException(message);
+			if (result.status === 403) throw new ForbiddenException(message);
+			throw new HttpException(result.body, result.status);
+		}
+		const user = requestContext.get(MASTRA_USER_KEY);
+		if (user !== void 0) request.user = user;
+		return user;
 	}
 	/**
 	* Extract authentication token from request.
@@ -545,11 +689,16 @@ let AuthService = _AuthService = class AuthService {
 		}
 	}
 };
-AuthService = _AuthService = __decorate([
+AuthService = __decorate([
 	Injectable(),
 	__decorateParam(0, Inject(MASTRA)),
 	__decorateParam(1, Inject(MASTRA_OPTIONS)),
-	__decorateMetadata("design:paramtypes", [Object, Object])
+	__decorateParam(2, Inject(CustomRouteService)),
+	__decorateMetadata("design:paramtypes", [
+		Object,
+		Object,
+		typeof CustomRouteService === "undefined" ? Object : CustomRouteService
+	])
 ], AuthService);
 //#endregion
 //#region src/services/request-context.service.ts
@@ -828,14 +977,12 @@ MastraThrottleGuard = _MastraThrottleGuard = __decorate([
 //#endregion
 //#region src/guards/mastra-route.guard.ts
 let MastraRouteGuard = class MastraRouteGuard {
-	mastra;
 	options;
 	routeHandler;
 	requestContext;
 	authService;
 	throttleGuard;
-	constructor(mastra, options, routeHandler, requestContext, authService, throttleGuard) {
-		this.mastra = mastra;
+	constructor(options, routeHandler, requestContext, authService, throttleGuard) {
 		this.options = options;
 		this.routeHandler = routeHandler;
 		this.requestContext = requestContext;
@@ -846,29 +993,29 @@ let MastraRouteGuard = class MastraRouteGuard {
 		const request = context.switchToHttp().getRequest();
 		const method = request.method.toUpperCase();
 		const routePath = getMastraRoutePath(request.path, this.options.prefix);
-		if (!routePath) return true;
-		if (!this.routeHandler.matchRoute(method, routePath)) return true;
-		if (this.options.auth?.enabled !== false && (this.options.auth?.enabled || this.mastra.getServer()?.auth)) {
-			const user = await this.authService.authenticate(request);
+		if (!(routePath ? this.routeHandler.matchRoute(method, routePath) : void 0)) return true;
+		if (this.authService.isEnabled()) {
+			const user = await this.authService.authenticate(request, {
+				requestContext: this.requestContext.requestContext,
+				response: context.switchToHttp().getResponse()
+			});
 			if (user !== void 0) this.requestContext.setUser(user);
 		}
 		if (this.options.rateLimitOptions?.enabled !== false) {
-			const { limit, windowMs } = this.throttleGuard.getRateLimitSettings(request, void 0, routePath);
-			await this.throttleGuard.checkLimit(request, limit, windowMs, routePath);
+			const { limit, windowMs } = this.throttleGuard.getRateLimitSettings(request, void 0, routePath ?? void 0);
+			await this.throttleGuard.checkLimit(request, limit, windowMs, routePath ?? void 0);
 		}
 		return true;
 	}
 };
 MastraRouteGuard = __decorate([
 	Injectable({ scope: Scope.REQUEST }),
-	__decorateParam(0, Inject(MASTRA)),
-	__decorateParam(1, Inject(MASTRA_OPTIONS)),
-	__decorateParam(2, Inject(RouteHandlerService)),
-	__decorateParam(3, Inject(RequestContextService)),
-	__decorateParam(4, Inject(AuthService)),
-	__decorateParam(5, Inject(MastraThrottleGuard)),
+	__decorateParam(0, Inject(MASTRA_OPTIONS)),
+	__decorateParam(1, Inject(RouteHandlerService)),
+	__decorateParam(2, Inject(RequestContextService)),
+	__decorateParam(3, Inject(AuthService)),
+	__decorateParam(4, Inject(MastraThrottleGuard)),
 	__decorateMetadata("design:paramtypes", [
-		Object,
 		Object,
 		typeof RouteHandlerService === "undefined" ? Object : RouteHandlerService,
 		typeof RequestContextService === "undefined" ? Object : RequestContextService,
@@ -10831,18 +10978,36 @@ let MastraController = class MastraController {
 	options;
 	routeHandler;
 	requestContext;
-	constructor(options, routeHandler, requestContext) {
+	customRoutes;
+	authService;
+	constructor(options, routeHandler, requestContext, customRoutes, authService) {
 		this.options = options;
 		this.routeHandler = routeHandler;
 		this.requestContext = requestContext;
+		this.customRoutes = customRoutes;
+		this.authService = authService;
 	}
 	/**
 	* Catch-all handler that matches incoming requests to Mastra routes.
 	*/
-	async handleRequest(req, _res) {
+	async handleRequest(req, res) {
 		const path = req.path;
 		const method = req.method.toUpperCase();
 		const routePath = getMastraRoutePath(path, this.options.prefix);
+		if (!routePath || !this.routeHandler.matchRoute(method, routePath)) {
+			const requestContext = this.requestContext.requestContext;
+			const authenticate = async (requiresAuth) => {
+				if (!this.authService.isEnabled()) return;
+				const user = await this.authService.authenticate(req, {
+					requestContext,
+					response: res,
+					requiresAuth,
+					customRoute: true
+				});
+				if (user !== void 0) this.requestContext.setUser(user);
+			};
+			if (await this.customRoutes.handle(req, res, requestContext, authenticate)) return;
+		}
 		if (!routePath) throw new NotFoundException(`Route not found: ${method} ${path}`);
 		if (routePath.includes("//")) throw new NotFoundException(`Route not found: ${method} ${path}`);
 		const matchResult = this.routeHandler.matchRoute(method, routePath);
@@ -10921,10 +11086,14 @@ MastraController = __decorate([
 	__decorateParam(0, Inject(MASTRA_OPTIONS)),
 	__decorateParam(1, Inject(RouteHandlerService)),
 	__decorateParam(2, Inject(RequestContextService)),
+	__decorateParam(3, Inject(CustomRouteService)),
+	__decorateParam(4, Inject(AuthService)),
 	__decorateMetadata("design:paramtypes", [
 		Object,
 		typeof RouteHandlerService === "undefined" ? Object : RouteHandlerService,
-		typeof RequestContextService === "undefined" ? Object : RequestContextService
+		typeof RequestContextService === "undefined" ? Object : RequestContextService,
+		typeof CustomRouteService === "undefined" ? Object : CustomRouteService,
+		typeof AuthService === "undefined" ? Object : AuthService
 	])
 ], MastraController);
 //#endregion
@@ -11085,7 +11254,7 @@ let MastraAuthGuard = _MastraAuthGuard = class MastraAuthGuard {
 		if (this.reflector.getAllAndOverride("isPublic", [context.getHandler(), context.getClass()])) return true;
 		const request = context.switchToHttp().getRequest();
 		try {
-			await this.authService.authenticate(request);
+			await this.authService.authenticate(request, { response: context.switchToHttp().getResponse() });
 			return true;
 		} catch (error) {
 			this.logger.error(`Authentication error: ${error instanceof Error ? error.message : String(error)}`);
@@ -11299,6 +11468,7 @@ let MastraModule = _MastraModule = class MastraModule {
 				RequestContextService,
 				ShutdownService,
 				AuthService,
+				CustomRouteService,
 				BodyLimitMiddleware,
 				JsonBodyMiddleware,
 				MastraAuthGuard,
@@ -11373,6 +11543,7 @@ let MastraModule = _MastraModule = class MastraModule {
 				RequestContextService,
 				ShutdownService,
 				AuthService,
+				CustomRouteService,
 				BodyLimitMiddleware,
 				JsonBodyMiddleware,
 				MastraAuthGuard,
@@ -11399,6 +11570,6 @@ let MastraModule = _MastraModule = class MastraModule {
 };
 MastraModule = _MastraModule = __decorate([Module({})], MastraModule);
 //#endregion
-export { AuthService, BodyLimitMiddleware, JsonBodyMiddleware, MASTRA, MASTRA_OPTIONS, MastraAuthGuard, MastraExceptionFilter, MastraModule, MastraService, MastraThrottle, MastraThrottleGuard, NestMastraServer, Public, RequestContextService, RequestTrackingInterceptor, RouteHandlerService, ShutdownService, SkipThrottle, StreamingInterceptor, TracingInterceptor, ValidationError, parseMultipartFormData };
+export { AuthService, BodyLimitMiddleware, CustomRouteService, JsonBodyMiddleware, MASTRA, MASTRA_OPTIONS, MastraAuthGuard, MastraExceptionFilter, MastraModule, MastraService, MastraThrottle, MastraThrottleGuard, NestMastraServer, Public, RequestContextService, RequestTrackingInterceptor, RouteHandlerService, ShutdownService, SkipThrottle, StreamingInterceptor, TracingInterceptor, ValidationError, parseMultipartFormData };
 
 //# sourceMappingURL=index.js.map