Mastra 1.64.0

Apply the Node.js 24 and TypeScript 7 prompts first. These rules cover @mastra/core 1.64.0 and the companion packages documented at that release. Core requires Node.js >=22.13.0, accepts Zod ^3.25.0 or ^4.0.0, and provides both ESM and CommonJS exports. Companion packages have independent version numbers.

Server exposure and authentication

• Configure server.auth before anyone else can reach the process: with no auth provider every built-in route, custom route, and Studio session is public.
• Update server.auth.protected and server.auth.public whenever you set a custom server.apiPrefix, because the defaults only match /api/* and stop covering built-in routes.
• Keep SimpleAuth out of production: its tokens live in memory, never expire, are compared without cryptographic verification, and are also read from X-Playground-Access.
• Verify JWT signatures with MastraJwtAuth or verifyJwks, and enforce expected algorithms, issuer, audience, and expiry in the authentication implementation; decodeToken proves none of these.
• Write authorizeUser as a real policy decision instead of an existence check such as !!user.id, because it is the last gate before the route handler runs.
• Review every custom route marked requiresAuth: false, since Mastra skips both route auth and user server.middleware on those paths.
• Configure an auth provider before splitting workers out, or /api/workflows/:workflowId/runs/:runId/steps/execute and /api/workflows/events accept any caller.
• Give each worker type its own credential in MASTRA_WORKER_AUTH_TOKEN, carry