Mastra 1.63.2

Apply the Node.js 24 and TypeScript 7 prompts first. These rules target @mastra/core 1.63.2 and the companion APIs documented at that release. Core requires Node.js >=22.13.0; use Node.js 24.

Server exposure and authentication

• Configure server.auth before exposing the API or Studio. With no auth configured, built-in and custom routes are public; setting requiresAuth: true on a route does not establish an identity provider.
• Update server.auth.protected and server.auth.public whenever server.apiPrefix changes. The defaults protect /api/* and exempt /api and /api/auth/*; verify coverage of every deployed route and method under the actual prefix.
• Keep requiresAuth: false and public path patterns limited to intentionally public endpoints. Mastra skips user middleware on routes declared public with requiresAuth: false, so protect webhook actions inside their handler or an upstream boundary.
• Install security middleware through the serving framework's supported API. server.middleware uses Hono handlers and does not run on Express, Fastify, or Koa adapters; those adapters need their native middleware. Middleware paths must explicitly include the configured API prefix.
• Resolve identity with getAuthenticatedUser() when Hono middleware needs the verified user: server.middleware runs before per-route authentication. Implement resource authorization in authorizeUser() or application policy rather than accepting any user with an ID.
• Restrict server.cors.origin from its '*' default to approved browser origins and enable credentials only