@scoutqa/mastra-core 0.24.6-fork.1

package/dist/server/index.js

@@ -0,0 +1,180 @@
+import { InstrumentClass } from '../chunk-BLUDYAPI.js';
+import { MastraError } from '../chunk-PZUZNPFM.js';
+import { MastraBase } from '../chunk-VQASQG5D.js';
+import { __decoratorStart, __decorateElement, __runInitializers } from '../chunk-3HXBPDKN.js';
+
+// src/server/auth.ts
+var _MastraAuthProvider_decorators, _init, _a;
+_MastraAuthProvider_decorators = [InstrumentClass({
+  prefix: "auth",
+  excludeMethods: ["__setTools", "__setLogger", "__setTelemetry", "#log"]
+})];
+var MastraAuthProvider = class extends (_a = MastraBase) {
+  protected;
+  public;
+  constructor(options) {
+    super({
+      component: "AUTH",
+      name: options?.name
+    });
+    if (options?.authorizeUser) {
+      this.authorizeUser = options.authorizeUser.bind(this);
+    }
+    this.protected = options?.protected;
+    this.public = options?.public;
+  }
+  registerOptions(opts) {
+    if (opts?.authorizeUser) {
+      this.authorizeUser = opts.authorizeUser.bind(this);
+    }
+    if (opts?.protected) {
+      this.protected = opts.protected;
+    }
+    if (opts?.public) {
+      this.public = opts.public;
+    }
+  }
+};
+MastraAuthProvider = /*@__PURE__*/(_ => {
+  _init = __decoratorStart(_a);
+  MastraAuthProvider = __decorateElement(_init, 0, "MastraAuthProvider", _MastraAuthProvider_decorators, MastraAuthProvider);
+  __runInitializers(_init, 1, MastraAuthProvider);
+
+  // src/server/composite-auth.ts
+  return MastraAuthProvider;
+})();
+// src/server/composite-auth.ts
+var CompositeAuth = class extends MastraAuthProvider {
+  providers;
+  constructor(providers) {
+    super();
+    this.providers = providers;
+  }
+  async authenticateToken(token, request) {
+    for (const provider of this.providers) {
+      try {
+        const user = await provider.authenticateToken(token, request);
+        if (user) {
+          return user;
+        }
+      } catch {}
+    }
+    return null;
+  }
+  async authorizeUser(user, request) {
+    for (const provider of this.providers) {
+      const authorized = await provider.authorizeUser(user, request);
+      if (authorized) {
+        return true;
+      }
+    }
+    return false;
+  }
+};
+
+// src/server/simple-auth.ts
+var SimpleAuth = class extends MastraAuthProvider {
+  tokens;
+  headerNames;
+  authenticatedUsers;
+  constructor(options) {
+    super(options);
+    this.tokens = options.tokens;
+    this.headerNames = this.normalizeHeaders(options.headers);
+    this.authenticatedUsers = new Set(Object.values(this.tokens));
+  }
+  normalizeHeaders(headers) {
+    if (!headers) {
+      return ["Authorization"];
+    }
+    return Array.isArray(headers) ? headers : [headers];
+  }
+  extractBearerToken(value) {
+    if (value.startsWith("Bearer ")) {
+      return value.slice(7);
+    }
+    return value;
+  }
+  findTokenInHeaders(request) {
+    for (const headerName of this.headerNames) {
+      const headerValue = request.header(headerName);
+      if (headerValue) {
+        if (headerName.toLowerCase() === "authorization") {
+          return this.extractBearerToken(headerValue);
+        }
+        return headerValue;
+      }
+    }
+    return null;
+  }
+  async authenticateToken(token, request) {
+    const directToken = this.extractBearerToken(token);
+    if (directToken in this.tokens) {
+      return this.tokens[directToken];
+    }
+    const headerToken = this.findTokenInHeaders(request);
+    if (headerToken && headerToken in this.tokens) {
+      return this.tokens[headerToken];
+    }
+    return null;
+  }
+  async authorizeUser(user, _request) {
+    return this.authenticatedUsers.has(user);
+  }
+};
+
+// src/server/index.ts
+function validateOptions(path, options) {
+  const opts = options;
+  if (opts.method === void 0) {
+    throw new MastraError({
+      id: "MASTRA_SERVER_API_INVALID_ROUTE_OPTIONS",
+      text: `Invalid options for route "${path}", missing "method" property`,
+      domain: "MASTRA_SERVER" /* MASTRA_SERVER */,
+      category: "USER" /* USER */
+    });
+  }
+  if (opts.handler === void 0 && opts.createHandler === void 0) {
+    throw new MastraError({
+      id: "MASTRA_SERVER_API_INVALID_ROUTE_OPTIONS",
+      text: `Invalid options for route "${path}", you must define a "handler" or "createHandler" property`,
+      domain: "MASTRA_SERVER" /* MASTRA_SERVER */,
+      category: "USER" /* USER */
+    });
+  }
+  if (opts.handler !== void 0 && opts.createHandler !== void 0) {
+    throw new MastraError({
+      id: "MASTRA_SERVER_API_INVALID_ROUTE_OPTIONS",
+      text: `Invalid options for route "${path}", you can only define one of the following properties: "handler" or "createHandler"`,
+      domain: "MASTRA_SERVER" /* MASTRA_SERVER */,
+      category: "USER" /* USER */
+    });
+  }
+}
+function registerApiRoute(path, options) {
+  if (path.startsWith("/api/")) {
+    throw new MastraError({
+      id: "MASTRA_SERVER_API_PATH_RESERVED",
+      text: `Path must not start with "/api", it's reserved for internal API routes`,
+      domain: "MASTRA_SERVER" /* MASTRA_SERVER */,
+      category: "USER" /* USER */
+    });
+  }
+  validateOptions(path, options);
+  return {
+    path,
+    method: options.method,
+    handler: options.handler,
+    createHandler: options.createHandler,
+    openapi: options.openapi,
+    middleware: options.middleware,
+    requiresAuth: options.requiresAuth
+  };
+}
+function defineAuth(config) {
+  return config;
+}
+
+export { CompositeAuth, MastraAuthProvider, SimpleAuth, defineAuth, registerApiRoute };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/server/auth.ts","../../src/server/composite-auth.ts","../../src/server/simple-auth.ts","../../src/server/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,MAAA,SAAA,EAAA,MAAA;AAkBA,MAAA,IAAA,EAAA,OAAA,EAAA;AAAiB,KACf,CAAA;AAAQ,IACR,IAAA,OAAA,EAAA,aAAiB,EAAA;AACnB,MAAC,IAAA,CAAA,aAAA,GAAA,OAAA,CAAA,aAAA,CAAA,IAAA,CAAA,IAAA,CAAA;AACM,IAAe;AAAuD,IACpE,IAAA,CAAA,SAAA,GAAA,OAAA,EAAA,SAAA;AAAA,IACA,IAAA,CAAA,MAAA,GAAA,OAAA,EAAA,MAAA;AAAA,EAEP;AACE,EAAA,eAAQ,CAAA,IAAA,EAAW;AAEnB,IAAA,IAAI,mBAAS,EAAA;AACX,MAAA,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAA,aAAQ,CAAA,IAAc,CAAA,IAAK,CAAA;AAAI,IACtD;AAEA,IAAA,IAAA,eAAiB,EAAA;AACjB,MAAA,cAAc,GAAA,IAAS,CAAA,SAAA;AAAA,IACzB;AAAA,oBAkB0B,EAAA;AACxB,MAAA,WAAU,GAAA,IAAA,CAAA,MAAe;AACvB,IAAA;AAAiD,EAAA;AAEnD;AACE,kCAAsB,CAAA,CAAA,IAAA;AAAA,EAAA,KACxB,GAAA,gBAAA,CAAA,EAAA,CAAA;AACA,EAAA,kBAAU,GAAQ,iBAAA,CAAA,KAAA,EAAA,CAAA,EAAA,oBAAA,EAAA,8BAAA,EAAA,kBAAA,CAAA;AAChB,EAAA,kBAAc,KAAK,EAAA,CAAA,EAAA,kBAAA,CAAA;;AACrB;AAEJ,EAAA,OAAA,kBAAA;AA1CO,CAAA,EAAA;AAAe;AAAf,IAAA,aAAA,GAAA,cAAe,kBAAA,CAAA;;;ACnBf,IAAM,KAAA,EAAA;AAAyC,IAC5C,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAER;AACE,EAAA,MAAA,iBAAM,CAAA,KAAA,EAAA,OAAA,EAAA;AACN,IAAA,KAAK,MAAA,QAAY,IAAA,IAAA,CAAA,SAAA,EAAA;AAAA,MACnB,IAAA;AAAA,QAEM,MAAA,IAAA,GAAA,MAAkB,QAAe,CAAA,iBAA+C,CAAA,KAAA,EAAA,OAAA,CAAA;AACpF,QAAA,IAAA,IAAW,EAAA;AACT,UAAI,OAAA,IAAA;AACF,QAAA;AACA,MAAA,CAAA,CAAA,MAAI,CAAA;AACF,IAAA;AAAO,IAAA,OACT,IAAA;AAAA,EAAA;AACM,EAAA,MAER,aAAA,CAAA,IAAA,EAAA,OAAA,EAAA;AAAA,IACF,KAAA,MAAA,QAAA,IAAA,IAAA,CAAA,SAAA,EAAA;AACA,MAAA,MAAO,UAAA,GAAA,MAAA,QAAA,CAAA,aAAA,CAAA,IAAA,EAAA,OAAA,CAAA;AAAA,MACT,IAAA,UAAA,EAAA;AAAA,QAEM,OAAA,IAAA;AACJ,MAAA;AACE,IAAA;AACA,IAAA,OAAI,KAAA;AACF,EAAA;AAAO;;AAGX;AACF,IAAA,UAAA,GAAA,cAAA,kBAAA,CAAA;AACF,EAAA,MAAA;;;ACZO,EAAA,WAAM,CAAA;AAA8D,IACjE,KAAA,CAAA,OAAA,CAAA;AAAA,IACA,IAAA,CAAA,MAAA,GAAA,OAAA,CAAA,MAAA;AAAA,IACA,IAAA,CAAA,WAAA,GAAA,IAAA,CAAA,gBAAA,CAAA,OAAA,CAAA,OAAA,CAAA;AAAA,2BAEuC,GAAA,IAAA,GAAA,CAAA,MAAA,CAAA,MAAA,CAAA,IAAA,CAAA,MAAA,CAAA,CAAA;AAC7C,EAAA;AACA,EAAA,gBAAc,CAAA,OAAQ,EAAA;AACtB,IAAA,IAAA,CAAK,OAAA,EAAA;AAEL,MAAA,wBAA0B;AAAkC,IAC9D;AAAA,wBAEyB,CAAA,OAAuC,CAAA,GAAA,OAAA,GAAA,CAAA,OAAA,CAAA;AAC9D,EAAA;AACE,EAAA,kBAAQ,CAAA,KAAA,EAAA;AAAe,IACzB,IAAA,KAAA,CAAA,UAAA,CAAA,SAAA,CAAA,EAAA;AACA,MAAA,YAAa,CAAA,KAAA,CAAQ,CAAA,CAAA;AAA6B,IACpD;AAAA;AAGE,EAAA;AACE,EAAA,0BAAoB,EAAA;AAAA,IACtB,KAAA,MAAA,UAAA,IAAA,IAAA,CAAA,WAAA,EAAA;AACA,MAAA,MAAO,WAAA,GAAA,OAAA,CAAA,MAAA,CAAA,UAAA,CAAA;AAAA,MACT,IAAA,WAAA,EAAA;AAAA,sBAE2B,CAAA,WAAqC,EAAA,KAAA,eAAA,EAAA;AAC9D,UAAA,OAAW,IAAA,CAAA,kBAAmB,CAAA,WAAa,CAAA;AACzC,QAAA;AACA,QAAA,OAAI,WAAa;AAEf,MAAA;AACE,IAAA;AAA0C,IAAA,OAC5C,IAAA;AACA,EAAA;AAAO,EAAA,MACT,iBAAA,CAAA,KAAA,EAAA,OAAA,EAAA;AAAA,IACF,MAAA,WAAA,GAAA,IAAA,CAAA,kBAAA,CAAA,KAAA,CAAA;AACA,IAAA,IAAA,WAAO,IAAA,IAAA,CAAA,MAAA,EAAA;AAAA,MACT,OAAA,IAAA,CAAA,MAAA,CAAA,WAAA,CAAA;AAAA,IAEA;AAEE,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,kBAAA,CAAmB,OAAK,CAAA;AACjD,IAAA,IAAI,WAAA,IAAe,WAAK,IAAQ,IAAA,CAAA,MAAA,EAAA;AAC9B,MAAA,OAAO,IAAA,CAAK,OAAO,WAAW,CAAA;AAAA,IAChC;AAGA,IAAA,OAAM,IAAA;AACN,EAAA;AACE,EAAA,MAAA,kBAAmB,EAAA,QAAW,EAAA;AAAA,IAChC,OAAA,IAAA,CAAA,kBAAA,CAAA,GAAA,CAAA,IAAA,CAAA;AAEA,EAAA;AAAO;;AAKP;AAAuC,SACzC,eAAA,CAAA,IAAA,EAAA,OAAA,EAAA;AACF,EAAA,MAAA,IAAA,GAAA,OAAA;;;AC/BA,MAAA,EAAA,EAAS,yCAGwC;AAC/C,MAAA,IAAM,EAAA,CAAA,2BAAO,EAAA,IAAA,CAAA,4BAAA,CAAA;AAEb,MAAI,uBAAgB;AAClB,MAAA,QAAU,EAAA,MAAA;AAAY,KAAA,CACpB;AAAI,EAAA;AACoC,EAAA,IACxC,IAAA,CAAA,OAAA,KAAA,MAAA,IAAA,IAAA,CAAA,aAAA,KAAA,MAAA,EAAA;AAAA,IAAA,MACA,IAAA,WAAA,CAAA;AAAA,MACD,EAAA,EAAA,yCAAA;AAAA,MACH,IAAA,EAAA,CAAA,2BAAA,EAAA,IAAA,CAAA,0DAAA,CAAA;AAEA,MAAI,MAAK,EAAA,eAAY;AACnB,MAAA,QAAU,EAAA,MAAA;AAAY,KAAA,CACpB;AAAI,EAAA;AACoC,EAAA,IACxC,IAAA,CAAA,OAAA,KAAA,MAAA,IAAA,IAAA,CAAA,aAAA,KAAA,MAAA,EAAA;AAAA,IAAA,MACA,IAAA,WAAA,CAAA;AAAA,MACD,EAAA,EAAA,yCAAA;AAAA,MACH,IAAA,EAAA,CAAA,2BAAA,EAAA,IAAA,CAAA,oFAAA,CAAA;AAEA,MAAI,MAAK,EAAA,eAAY;AACnB,MAAA,QAAU,EAAA,MAAA;AAAY,KAAA,CACpB;AAAI,EAAA;AACoC;AACxC,SACA,gBAAA,CAAA,IAAA,EAAA,OAAA,EAAA;AAAA,EAAA,IACD,IAAA,CAAA,UAAA,CAAA,OAAA,CAAA,EAAA;AAAA,IACH,MAAA,IAAA,WAAA,CAAA;AACF,MAAA,EAAA,EAAA,iCAAA;AAEO,MAAA,IAAS,EAAA,CAAA,sEAGa,CAAA;AAC3B,MAAI,MAAK,EAAA,eAAkB;AACzB,MAAA,QAAU,EAAA,MAAA;AAAY,KAAA,CACpB;AAAI,EAAA;AACE,EAAA,eACN,CAAA,IAAA,EAAA,OAAA,CAAA;AAAA,EAAA,OACA;AAAA,IACF,IAAC;AAAA,IACH,MAAA,EAAA,OAAA,CAAA,MAAA;AAEA,IAAA,OAAA,EAAA,eAAsB;AAEtB,IAAA,aAAO,EAAA,OAAA,CAAA,aAAA;AAAA,IACL,OAAA,EAAA,OAAA,CAAA,OAAA;AAAA,IACA,UAAQ,EAAA,OAAQ,CAAA,UAAA;AAAA,IAChB,YAAS,EAAA,OAAQ,CAAA;AAAA,GAAA;AACM;AACN,mBACL,CAAA,MAAQ,EAAA;AAAA,EAAA;AACE","file":"index.js","sourcesContent":["import type { HonoRequest } from 'hono';\nimport { MastraBase } from '../base';\nimport { InstrumentClass } from '../telemetry';\nimport type { MastraAuthConfig } from './types';\n\nexport interface MastraAuthProviderOptions<TUser = unknown> {\n  name?: string;\n  authorizeUser?: (user: TUser, request: HonoRequest) => Promise<boolean> | boolean;\n  /**\n   * Protected paths for the auth provider\n   */\n  protected?: MastraAuthConfig['protected'];\n  /**\n   * Public paths for the auth provider\n   */\n  public?: MastraAuthConfig['public'];\n}\n\n@InstrumentClass({\n  prefix: 'auth',\n  excludeMethods: ['__setTools', '__setLogger', '__setTelemetry', '#log'],\n})\nexport abstract class MastraAuthProvider<TUser = unknown> extends MastraBase {\n  public protected?: MastraAuthConfig['protected'];\n  public public?: MastraAuthConfig['public'];\n\n  constructor(options?: MastraAuthProviderOptions<TUser>) {\n    super({ component: 'AUTH', name: options?.name });\n\n    if (options?.authorizeUser) {\n      this.authorizeUser = options.authorizeUser.bind(this);\n    }\n\n    this.protected = options?.protected;\n    this.public = options?.public;\n  }\n\n  /**\n   * Authenticate a token and return the payload\n   * @param token - The token to authenticate\n   * @param request - The request\n   * @returns The payload\n   */\n  abstract authenticateToken(token: string, request: HonoRequest): Promise<TUser | null>;\n\n  /**\n   * Authorize a user for a path and method\n   * @param user - The user to authorize\n   * @param request - The request\n   * @returns The authorization result\n   */\n  abstract authorizeUser(user: TUser, request: HonoRequest): Promise<boolean> | boolean;\n\n  protected registerOptions(opts?: MastraAuthProviderOptions<TUser>) {\n    if (opts?.authorizeUser) {\n      this.authorizeUser = opts.authorizeUser.bind(this);\n    }\n    if (opts?.protected) {\n      this.protected = opts.protected;\n    }\n    if (opts?.public) {\n      this.public = opts.public;\n    }\n  }\n}\n","import type { HonoRequest } from 'hono';\nimport { MastraAuthProvider } from './auth';\n\nexport class CompositeAuth extends MastraAuthProvider {\n  private providers: MastraAuthProvider[];\n\n  constructor(providers: MastraAuthProvider[]) {\n    super();\n    this.providers = providers;\n  }\n\n  async authenticateToken(token: string, request: HonoRequest): Promise<unknown | null> {\n    for (const provider of this.providers) {\n      try {\n        const user = await provider.authenticateToken(token, request);\n        if (user) {\n          return user;\n        }\n      } catch {\n        // ignore error, try next provider\n      }\n    }\n    return null;\n  }\n\n  async authorizeUser(user: unknown, request: HonoRequest): Promise<boolean> {\n    for (const provider of this.providers) {\n      const authorized = await provider.authorizeUser(user, request);\n      if (authorized) {\n        return true;\n      }\n    }\n    return false;\n  }\n}\n","import type { HonoRequest } from 'hono';\nimport { MastraAuthProvider } from './auth';\nimport type { MastraAuthProviderOptions } from './auth';\n\nexport interface SimpleAuthOptions<TUser = unknown> extends MastraAuthProviderOptions<TUser> {\n  /**\n   * A map of tokens to users.\n   * When a token is provided, it will be looked up in this map.\n   */\n  tokens: Record<string, TUser>;\n  /**\n   * Headers to check for the token.\n   * Defaults to 'Authorization' with Bearer token extraction.\n   * Can be a string or array of strings for custom header names.\n   */\n  headers?: string | string[];\n}\n\n/**\n * SimpleAuth is a basic token-based authentication provider.\n * It validates tokens against a predefined map of tokens to users.\n */\nexport class SimpleAuth<TUser = unknown> extends MastraAuthProvider<TUser> {\n  private tokens: Record<string, TUser>;\n  private headerNames: string[];\n  private authenticatedUsers: Set<TUser>;\n\n  constructor(options: SimpleAuthOptions<TUser>) {\n    super(options);\n    this.tokens = options.tokens;\n    this.headerNames = this.normalizeHeaders(options.headers);\n    // Store reference to all valid users for authorization\n    this.authenticatedUsers = new Set(Object.values(this.tokens));\n  }\n\n  private normalizeHeaders(headers?: string | string[]): string[] {\n    if (!headers) {\n      return ['Authorization'];\n    }\n    return Array.isArray(headers) ? headers : [headers];\n  }\n\n  private extractBearerToken(value: string): string {\n    if (value.startsWith('Bearer ')) {\n      return value.slice(7);\n    }\n    return value;\n  }\n\n  private findTokenInHeaders(request: HonoRequest): string | null {\n    for (const headerName of this.headerNames) {\n      const headerValue = request.header(headerName);\n      if (headerValue) {\n        // For Authorization header, extract Bearer token\n        if (headerName.toLowerCase() === 'authorization') {\n          return this.extractBearerToken(headerValue);\n        }\n        return headerValue;\n      }\n    }\n    return null;\n  }\n\n  async authenticateToken(token: string, request: HonoRequest): Promise<TUser | null> {\n    // First, try the direct token\n    const directToken = this.extractBearerToken(token);\n    if (directToken in this.tokens) {\n      return this.tokens[directToken]!;\n    }\n\n    // Then, try to find token in headers\n    const headerToken = this.findTokenInHeaders(request);\n    if (headerToken && headerToken in this.tokens) {\n      return this.tokens[headerToken]!;\n    }\n\n    return null;\n  }\n\n  async authorizeUser(user: TUser, _request: HonoRequest): Promise<boolean> {\n    // Check if this user was authenticated through our tokens\n    return this.authenticatedUsers.has(user);\n  }\n}\n","import type { Context, Handler, MiddlewareHandler } from 'hono';\nimport type { DescribeRouteOptions } from 'hono-openapi';\nimport { MastraError, ErrorDomain, ErrorCategory } from '../error';\nimport type { Mastra } from '../mastra';\nimport type { ApiRoute, MastraAuthConfig, Methods } from './types';\n\nexport type { MastraAuthConfig, ContextWithMastra, ApiRoute } from './types';\nexport { MastraAuthProvider } from './auth';\nexport type { MastraAuthProviderOptions } from './auth';\nexport { CompositeAuth } from './composite-auth';\nexport { SimpleAuth } from './simple-auth';\nexport type { SimpleAuthOptions } from './simple-auth';\n\n// Helper type for inferring parameters from a path\n// Thank you Claude!\ntype ParamsFromPath<P extends string> = {\n  [K in P extends `${string}:${infer Param}/${string}` | `${string}:${infer Param}` ? Param : never]: string;\n};\n\ntype RegisterApiRoutePathError = `Param 'path' must not start with '/api', it is reserved for internal API routes.`;\ntype ValidatePath<P extends string, T> = P extends `/api/${string}` ? RegisterApiRoutePathError : T;\n\ntype RegisterApiRouteOptions<P extends string> = {\n  method: Methods;\n  openapi?: DescribeRouteOptions;\n  handler?: Handler<\n    {\n      Variables: {\n        mastra: Mastra;\n      };\n    },\n    P,\n    ParamsFromPath<P>\n  >;\n  createHandler?: (c: Context) => Promise<\n    Handler<\n      {\n        Variables: {\n          mastra: Mastra;\n        };\n      },\n      P,\n      ParamsFromPath<P>\n    >\n  >;\n  middleware?: MiddlewareHandler | MiddlewareHandler[];\n  /**\n   * When false, skips Mastra auth for this route (defaults to true)\n   */\n  requiresAuth?: boolean;\n};\n\nfunction validateOptions<P extends string>(\n  path: P,\n  options: RegisterApiRoutePathError | RegisterApiRouteOptions<P>,\n): asserts options is RegisterApiRouteOptions<P> {\n  const opts = options as RegisterApiRouteOptions<P>;\n\n  if (opts.method === undefined) {\n    throw new MastraError({\n      id: 'MASTRA_SERVER_API_INVALID_ROUTE_OPTIONS',\n      text: `Invalid options for route \"${path}\", missing \"method\" property`,\n      domain: ErrorDomain.MASTRA_SERVER,\n      category: ErrorCategory.USER,\n    });\n  }\n\n  if (opts.handler === undefined && opts.createHandler === undefined) {\n    throw new MastraError({\n      id: 'MASTRA_SERVER_API_INVALID_ROUTE_OPTIONS',\n      text: `Invalid options for route \"${path}\", you must define a \"handler\" or \"createHandler\" property`,\n      domain: ErrorDomain.MASTRA_SERVER,\n      category: ErrorCategory.USER,\n    });\n  }\n\n  if (opts.handler !== undefined && opts.createHandler !== undefined) {\n    throw new MastraError({\n      id: 'MASTRA_SERVER_API_INVALID_ROUTE_OPTIONS',\n      text: `Invalid options for route \"${path}\", you can only define one of the following properties: \"handler\" or \"createHandler\"`,\n      domain: ErrorDomain.MASTRA_SERVER,\n      category: ErrorCategory.USER,\n    });\n  }\n}\n\nexport function registerApiRoute<P extends string>(\n  path: P,\n  options: ValidatePath<P, RegisterApiRouteOptions<P>>,\n): ValidatePath<P, ApiRoute> {\n  if (path.startsWith('/api/')) {\n    throw new MastraError({\n      id: 'MASTRA_SERVER_API_PATH_RESERVED',\n      text: 'Path must not start with \"/api\", it\\'s reserved for internal API routes',\n      domain: ErrorDomain.MASTRA_SERVER,\n      category: ErrorCategory.USER,\n    });\n  }\n\n  validateOptions(path, options);\n\n  return {\n    path,\n    method: options.method,\n    handler: options.handler,\n    createHandler: options.createHandler,\n    openapi: options.openapi,\n    middleware: options.middleware,\n    requiresAuth: options.requiresAuth,\n  } as unknown as ValidatePath<P, ApiRoute>;\n}\n\nexport function defineAuth<TUser>(config: MastraAuthConfig<TUser>): MastraAuthConfig<TUser> {\n  return config;\n}\n"]}

package/dist/server/simple-auth.d.ts

@@ -0,0 +1,32 @@
+import type { HonoRequest } from 'hono';
+import { MastraAuthProvider } from './auth.js';
+import type { MastraAuthProviderOptions } from './auth.js';
+export interface SimpleAuthOptions<TUser = unknown> extends MastraAuthProviderOptions<TUser> {
+    /**
+     * A map of tokens to users.
+     * When a token is provided, it will be looked up in this map.
+     */
+    tokens: Record<string, TUser>;
+    /**
+     * Headers to check for the token.
+     * Defaults to 'Authorization' with Bearer token extraction.
+     * Can be a string or array of strings for custom header names.
+     */
+    headers?: string | string[];
+}
+/**
+ * SimpleAuth is a basic token-based authentication provider.
+ * It validates tokens against a predefined map of tokens to users.
+ */
+export declare class SimpleAuth<TUser = unknown> extends MastraAuthProvider<TUser> {
+    private tokens;
+    private headerNames;
+    private authenticatedUsers;
+    constructor(options: SimpleAuthOptions<TUser>);
+    private normalizeHeaders;
+    private extractBearerToken;
+    private findTokenInHeaders;
+    authenticateToken(token: string, request: HonoRequest): Promise<TUser | null>;
+    authorizeUser(user: TUser, _request: HonoRequest): Promise<boolean>;
+}
+//# sourceMappingURL=simple-auth.d.ts.map

package/dist/server/simple-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simple-auth.d.ts","sourceRoot":"","sources":["../../src/server/simple-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AAC5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,QAAQ,CAAC;AAExD,MAAM,WAAW,iBAAiB,CAAC,KAAK,GAAG,OAAO,CAAE,SAAQ,yBAAyB,CAAC,KAAK,CAAC;IAC1F;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,qBAAa,UAAU,CAAC,KAAK,GAAG,OAAO,CAAE,SAAQ,kBAAkB,CAAC,KAAK,CAAC;IACxE,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,WAAW,CAAW;IAC9B,OAAO,CAAC,kBAAkB,CAAa;gBAE3B,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC;IAQ7C,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,kBAAkB;IAcpB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAgB7E,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;CAI1E"}

package/dist/server/types.d.ts

@@ -0,0 +1,140 @@
+import type { Handler, MiddlewareHandler, HonoRequest, Context } from 'hono';
+import type { cors } from 'hono/cors';
+import type { DescribeRouteOptions } from 'hono-openapi';
+import type { Mastra } from '../mastra/index.js';
+import type { RuntimeContext } from '../runtime-context/index.js';
+import type { MastraAuthProvider } from './auth.js';
+export type Methods = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'ALL';
+export type ApiRoute = {
+    path: string;
+    method: Methods;
+    handler: Handler;
+    middleware?: MiddlewareHandler | MiddlewareHandler[];
+    openapi?: DescribeRouteOptions;
+    requiresAuth?: boolean;
+} | {
+    path: string;
+    method: Methods;
+    createHandler: ({ mastra }: {
+        mastra: Mastra;
+    }) => Promise<Handler>;
+    middleware?: MiddlewareHandler | MiddlewareHandler[];
+    openapi?: DescribeRouteOptions;
+    requiresAuth?: boolean;
+};
+export type Middleware = MiddlewareHandler | {
+    path: string;
+    handler: MiddlewareHandler;
+};
+export type ContextWithMastra = Context<{
+    Variables: {
+        mastra: Mastra;
+        runtimeContext: RuntimeContext;
+        customRouteAuthConfig?: Map<string, boolean>;
+    };
+}>;
+export type MastraAuthConfig<TUser = unknown> = {
+    /**
+     * Protected paths for the server
+     */
+    protected?: (RegExp | string | [string, Methods | Methods[]])[];
+    /**
+     * Public paths for the server
+     */
+    public?: (RegExp | string | [string, Methods | Methods[]])[];
+    /**
+     * Public paths for the server
+     */
+    authenticateToken?: (token: string, request: HonoRequest) => Promise<TUser>;
+    /**
+     * Authorization function for the server
+     */
+    authorize?: (path: string, method: string, user: TUser, context: ContextWithMastra) => Promise<boolean>;
+    /**
+     * Rules for the server
+     */
+    rules?: {
+        /**
+         * Path for the rule
+         */
+        path?: RegExp | string | string[];
+        /**
+         * Method for the rule
+         */
+        methods?: Methods | Methods[];
+        /**
+         * Condition for the rule
+         */
+        condition?: (user: TUser) => Promise<boolean> | boolean;
+        /**
+         * Allow the rule
+         */
+        allow?: boolean;
+    }[];
+};
+export type ServerConfig = {
+    /**
+     * Port for the server
+     * @default 4111
+     */
+    port?: number;
+    /**
+     * Host for the server
+     * @default 'localhost'
+     */
+    host?: string;
+    /**
+     * Timeout for the server
+     */
+    timeout?: number;
+    /**
+     * Custom API routes for the server
+     */
+    apiRoutes?: ApiRoute[];
+    /**
+     * Middleware for the server
+     */
+    middleware?: Middleware | Middleware[];
+    /**
+     * CORS configuration for the server
+     * @default { origin: '*', allowMethods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'], allowHeaders: ['Content-Type', 'Authorization', 'x-mastra-client-type'], exposeHeaders: ['Content-Length', 'X-Requested-With'], credentials: false }
+     */
+    cors?: Parameters<typeof cors>[0] | false;
+    /**
+     * Build configuration for the server
+     */
+    build?: {
+        /**
+         * Enable Swagger UI
+         * @default false
+         */
+        swaggerUI?: boolean;
+        /**
+         * Enable API request logging
+         * @default false
+         */
+        apiReqLogs?: boolean;
+        /**
+         * Enable OpenAPI documentation
+         * @default false
+         */
+        openAPIDocs?: boolean;
+    };
+    /**
+     * Body size limit for the server
+     * @default 4.5mb
+     */
+    bodySizeLimit?: number;
+    /**
+     * Authentication configuration for the server
+     */
+    experimental_auth?: MastraAuthConfig<any> | MastraAuthProvider<any>;
+    /**
+     * If you want to run `mastra dev` with HTTPS, you can run it with the `--https` flag and provide the key and cert files here.
+     */
+    https?: {
+        key: Buffer;
+        cert: Buffer;
+    };
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/server/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC7E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AAEjD,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,KAAK,CAAC;AAE1E,MAAM,MAAM,QAAQ,GAChB;IACE,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,iBAAiB,GAAG,iBAAiB,EAAE,CAAC;IACrD,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,UAAU,CAAC,EAAE,iBAAiB,GAAG,iBAAiB,EAAE,CAAC;IACrD,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEN,MAAM,MAAM,UAAU,GAAG,iBAAiB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAE1F,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC;IACtC,SAAS,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,cAAc,EAAE,cAAc,CAAC;QAC/B,qBAAqB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC9C,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,MAAM,gBAAgB,CAAC,KAAK,GAAG,OAAO,IAAI;IAC9C;;OAEG;IACH,SAAS,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;IAEhE;;OAEG;IACH,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;IAE7D;;OAEG;IACH,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;IAE5E;;OAEG;IACH,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAExG;;OAEG;IACH,KAAK,CAAC,EAAE;QACN;;WAEG;QACH,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;QAClC;;WAEG;QACH,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,EAAE,CAAC;QAC9B;;WAEG;QACH,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;QACxD;;WAEG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,EAAE,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB;;OAEG;IACH,UAAU,CAAC,EAAE,UAAU,GAAG,UAAU,EAAE,CAAC;IACvC;;;OAGG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IAC1C;;OAEG;IACH,KAAK,CAAC,EAAE;QACN;;;WAGG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB;;;WAGG;QACH,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB;;;WAGG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IACF;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAEpE;;OAEG;IACH,KAAK,CAAC,EAAE;QACN,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH,CAAC"}