@mastra/cloudflare-sandbox 0.0.0 → 0.2.0-alpha.0

package/CHANGELOG.md

@@ -1 +1,12 @@
 # @mastra/cloudflare-sandbox
+
+## 0.2.0-alpha.0
+
+### Minor Changes
+
+- Add a Cloudflare Sandbox provider that executes commands and writes workspace files through a deployed Sandbox Bridge Worker. ([#21596](https://github.com/mastra-ai/mastra/pull/21596))
+
+### Patch Changes
+
+- Updated dependencies [[`6db7a5d`](https://github.com/mastra-ai/mastra/commit/6db7a5dd3dd2b6f7ef75dcd804fcffef5fa83963), [`0cdc5dc`](https://github.com/mastra-ai/mastra/commit/0cdc5dc69024957815da4f51acc4119eb4f447d7)]:
+  - @mastra/core@1.60.0-alpha.12

package/LICENSE.md

@@ -0,0 +1,30 @@
+Portions of this software are licensed as follows:
+
+- All content that resides under any directory named "ee/" within this
+  repository, including but not limited to:
+  - `packages/core/src/auth/ee/`
+  - `packages/server/src/server/auth/ee/`
+    is licensed under the license defined in `ee/LICENSE`.
+
+- All third-party components incorporated into the Mastra Software are
+  licensed under the original license provided by the owner of the
+  applicable component.
+
+- Content outside of the above-mentioned directories or restrictions is
+  available under the "Apache License 2.0" as defined below.
+
+# Apache License 2.0
+
+Copyright (c) 2025 Kepler Software, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/dist/bridge-client.d.ts

@@ -0,0 +1,59 @@
+export interface CloudflareSandboxBridgeClientOptions {
+    baseUrl: string;
+    apiToken?: string;
+    fetch?: typeof globalThis.fetch;
+}
+/** Terminal and streaming events emitted by `POST /v1/sandbox/:id/exec`. */
+export type CloudflareCommandEvent = {
+    type: 'stdout';
+    data: Uint8Array;
+} | {
+    type: 'stderr';
+    data: Uint8Array;
+} | {
+    type: 'exit';
+    exitCode: number;
+} | {
+    type: 'error';
+    message: string;
+    code?: string;
+};
+export interface CloudflareExecRequest {
+    /** Command and arguments. The bridge applies ANSI-C quoting to each element. */
+    argv: string[];
+    timeoutMs?: number;
+    cwd?: string;
+}
+export declare class CloudflareSandboxBridgeError extends Error {
+    readonly status: number;
+    readonly body: string;
+    constructor(status: number, body: string);
+}
+/**
+ * Client for the Cloudflare Sandbox Bridge Worker.
+ *
+ * @see https://developers.cloudflare.com/sandbox/bridge/http-api/
+ */
+export declare class CloudflareSandboxBridgeClient {
+    readonly baseUrl: string;
+    private readonly apiToken?;
+    private readonly fetchImpl;
+    constructor(options: CloudflareSandboxBridgeClientOptions);
+    /** `POST /v1/sandbox` */
+    createSandbox(): Promise<string>;
+    /** `GET /v1/sandbox/:id/running` */
+    isRunning(id: string): Promise<boolean>;
+    /** `DELETE /v1/sandbox/:id` */
+    deleteSandbox(id: string): Promise<void>;
+    /** `PUT /v1/sandbox/:id/file/*` — one file per request, raw bytes as the body. */
+    writeFile(id: string, absolutePath: string, content: Uint8Array | string): Promise<void>;
+    /** `POST /v1/sandbox/:id/exec` — streams SSE events until `exit` or `error`. */
+    exec(id: string, request: CloudflareExecRequest, options: {
+        signal?: AbortSignal;
+        onEvent: (event: CloudflareCommandEvent) => void;
+    }): Promise<void>;
+    private emitBlock;
+    private headers;
+    private request;
+}
+//# sourceMappingURL=bridge-client.d.ts.map

package/dist/bridge-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-client.d.ts","sourceRoot":"","sources":["../src/bridge-client.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oCAAoC;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC;AAED,4EAA4E;AAC5E,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,MAAM,WAAW,qBAAqB;IACpC,gFAAgF;IAChF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAMzC;AAmBD;;;;GAIG;AACH,qBAAa,6BAA6B;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;gBAExC,OAAO,EAAE,oCAAoC;IAMzD,yBAAyB;IACnB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAKtC,oCAAoC;IAC9B,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK7C,+BAA+B;IACzB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C,kFAAkF;IAC5E,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY9F,gFAAgF;IAC1E,IAAI,CACR,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE;QACP,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,OAAO,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,IAAI,CAAC;KAClD,GACA,OAAO,CAAC,IAAI,CAAC;IAqChB,OAAO,CAAC,SAAS;IAkCjB,OAAO,CAAC,OAAO;YAID,OAAO;CAWtB"}

package/dist/index.cjs

@@ -0,0 +1,344 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let crypto = require("crypto");
+let path = require("path");
+let _mastra_core_workspace = require("@mastra/core/workspace");
+//#region src/bridge-client.ts
+var CloudflareSandboxBridgeError = class extends Error {
+	status;
+	body;
+	constructor(status, body) {
+		super(`Cloudflare Sandbox Bridge request failed (${status}): ${body || "empty response"}`);
+		this.name = "CloudflareSandboxBridgeError";
+		this.status = status;
+		this.body = body;
+	}
+};
+function stripTrailingSlashes(url) {
+	let end = url.length;
+	while (end > 0 && url[end - 1] === "/") end--;
+	return url.slice(0, end);
+}
+/** Encodes an absolute sandbox path for the `/file/*` route, which omits the leading slash. */
+function encodeFilePath(absolutePath) {
+	let start = 0;
+	while (start < absolutePath.length && absolutePath[start] === "/") start++;
+	return absolutePath.slice(start).split("/").map((segment) => encodeURIComponent(segment)).join("/");
+}
+/**
+* Client for the Cloudflare Sandbox Bridge Worker.
+*
+* @see https://developers.cloudflare.com/sandbox/bridge/http-api/
+*/
+var CloudflareSandboxBridgeClient = class {
+	baseUrl;
+	apiToken;
+	fetchImpl;
+	constructor(options) {
+		this.baseUrl = stripTrailingSlashes(options.baseUrl);
+		this.apiToken = options.apiToken;
+		this.fetchImpl = options.fetch ?? globalThis.fetch;
+	}
+	/** `POST /v1/sandbox` */
+	async createSandbox() {
+		return (await this.request("/v1/sandbox", { method: "POST" })).id;
+	}
+	/** `GET /v1/sandbox/:id/running` */
+	async isRunning(id) {
+		return (await this.request(`/v1/sandbox/${encodeURIComponent(id)}/running`, {})).running === true;
+	}
+	/** `DELETE /v1/sandbox/:id` */
+	async deleteSandbox(id) {
+		await this.request(`/v1/sandbox/${encodeURIComponent(id)}`, { method: "DELETE" }, true);
+	}
+	/** `PUT /v1/sandbox/:id/file/*` — one file per request, raw bytes as the body. */
+	async writeFile(id, absolutePath, content) {
+		await this.request(`/v1/sandbox/${encodeURIComponent(id)}/file/${encodeFilePath(absolutePath)}`, {
+			method: "PUT",
+			body: content,
+			headers: { "content-type": "application/octet-stream" }
+		}, true);
+	}
+	/** `POST /v1/sandbox/:id/exec` — streams SSE events until `exit` or `error`. */
+	async exec(id, request, options) {
+		const response = await this.fetchImpl(`${this.baseUrl}/v1/sandbox/${encodeURIComponent(id)}/exec`, {
+			method: "POST",
+			headers: {
+				...this.headers(),
+				"content-type": "application/json",
+				accept: "text/event-stream"
+			},
+			body: JSON.stringify({
+				argv: request.argv,
+				...request.timeoutMs === void 0 ? {} : { timeout_ms: request.timeoutMs },
+				...request.cwd === void 0 ? {} : { cwd: request.cwd }
+			}),
+			signal: options.signal
+		});
+		if (!response.ok) throw new CloudflareSandboxBridgeError(response.status, await response.text());
+		if (!response.body) throw new Error("Cloudflare Sandbox Bridge returned an empty command stream");
+		const reader = response.body.getReader();
+		const decoder = new TextDecoder();
+		let buffer = "";
+		while (true) {
+			const { done, value } = await reader.read();
+			buffer += decoder.decode(value, { stream: !done }).replace(/\r\n/g, "\n");
+			let boundary = buffer.indexOf("\n\n");
+			while (boundary !== -1) {
+				this.emitBlock(buffer.slice(0, boundary), options.onEvent);
+				buffer = buffer.slice(boundary + 2);
+				boundary = buffer.indexOf("\n\n");
+			}
+			if (done) break;
+		}
+		if (buffer.trim()) this.emitBlock(buffer, options.onEvent);
+	}
+	emitBlock(block, onEvent) {
+		let eventName;
+		const dataLines = [];
+		for (const line of block.split("\n")) if (line.startsWith("event:")) eventName = line.slice(6).trim();
+		else if (line.startsWith("data:")) dataLines.push(line.slice(5).replace(/^ /, ""));
+		const data = dataLines.join("\n");
+		if (!eventName || !data) return;
+		switch (eventName) {
+			case "stdout":
+			case "stderr":
+				onEvent({
+					type: eventName,
+					data: base64ToBytes(data)
+				});
+				return;
+			case "exit": {
+				const parsed = safeJsonParse(data);
+				onEvent({
+					type: "exit",
+					exitCode: typeof parsed?.exit_code === "number" ? parsed.exit_code : 0
+				});
+				return;
+			}
+			case "error": {
+				const parsed = safeJsonParse(data);
+				onEvent({
+					type: "error",
+					message: typeof parsed?.error === "string" ? parsed.error : data,
+					code: typeof parsed?.code === "string" ? parsed.code : void 0
+				});
+				return;
+			}
+			default: return;
+		}
+	}
+	headers() {
+		return this.apiToken ? { authorization: `Bearer ${this.apiToken}` } : {};
+	}
+	async request(path, init, allowEmpty = false) {
+		const response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+			...init,
+			headers: {
+				...this.headers(),
+				...init.headers
+			}
+		});
+		if (!response.ok) throw new CloudflareSandboxBridgeError(response.status, await response.text());
+		if (allowEmpty || response.status === 204) return void 0;
+		return response.json();
+	}
+};
+function base64ToBytes(value) {
+	return new Uint8Array(Buffer.from(value, "base64"));
+}
+function safeJsonParse(value) {
+	try {
+		return JSON.parse(value);
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/sandbox.ts
+const DEFAULT_COMMAND_TIMEOUT_MS = 3e5;
+const WORKSPACE_ROOT = "/workspace";
+/**
+* Builds the argv array sent to the bridge. The bridge applies ANSI-C quoting to
+* every element, so no local escaping is needed. Environment variables are applied
+* with `env`, which keeps each assignment a separate argv element.
+*/
+function buildArgv(command, args, env) {
+	const assignments = Object.entries(env).map(([key, value]) => {
+		if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) throw new Error(`Invalid environment variable name: ${key}`);
+		return `${key}=${value}`;
+	});
+	const invocation = [command, ...args ?? []];
+	return assignments.length ? [
+		"env",
+		...assignments,
+		...invocation
+	] : invocation;
+}
+/** Resolves a path inside /workspace, rejecting anything that escapes the workspace root. */
+function resolveWorkspacePath(path$1) {
+	const resolved = path.posix.resolve(WORKSPACE_ROOT, path$1);
+	if (resolved !== WORKSPACE_ROOT && !resolved.startsWith(`${WORKSPACE_ROOT}/`)) throw new Error(`Cloudflare Sandbox files must be written under ${WORKSPACE_ROOT}: ${path$1}`);
+	return resolved;
+}
+var CloudflareSandbox = class extends _mastra_core_workspace.MastraSandbox {
+	id;
+	name;
+	provider = "cloudflare-sandbox";
+	status = "pending";
+	client;
+	env;
+	workingDirectory;
+	commandTimeout;
+	instructions;
+	sandboxId;
+	createdAt = /* @__PURE__ */ new Date();
+	lastUsedAt;
+	constructor(options) {
+		const name = options.name ?? "Cloudflare Sandbox";
+		super({
+			...options,
+			name
+		});
+		this.id = options.id ?? `cloudflare-sandbox-${(0, crypto.randomUUID)()}`;
+		this.name = name;
+		this.sandboxId = options.sandboxId;
+		this.env = { ...options.env };
+		this.workingDirectory = options.workingDirectory;
+		this.commandTimeout = options.commandTimeout ?? DEFAULT_COMMAND_TIMEOUT_MS;
+		this.instructions = options.instructions;
+		this.client = options.client ?? new CloudflareSandboxBridgeClient({
+			baseUrl: options.baseUrl,
+			apiToken: options.apiToken,
+			fetch: options.fetch
+		});
+	}
+	async start() {
+		if (this.sandboxId) {
+			if (!await this.client.isRunning(this.sandboxId)) this.logger?.debug(`Cloudflare sandbox ${this.sandboxId} is not running yet; it starts on first use`);
+			return;
+		}
+		this.sandboxId = await this.client.createSandbox();
+		this.createdAt = /* @__PURE__ */ new Date();
+	}
+	async stop() {}
+	async destroy() {
+		if (!this.sandboxId) return;
+		await this.client.deleteSandbox(this.sandboxId);
+		this.sandboxId = void 0;
+	}
+	async executeCommand(command, args, options) {
+		const sandboxId = this.requireSandboxId();
+		const startedAt = Date.now();
+		const timeout = options?.timeout ?? this.commandTimeout;
+		if (!Number.isFinite(timeout) || timeout <= 0) throw new RangeError("Command timeout must be positive");
+		const controller = new AbortController();
+		let didTimeout = false;
+		const timer = setTimeout(() => {
+			didTimeout = true;
+			controller.abort();
+		}, timeout);
+		const signal = options?.abortSignal ? AbortSignal.any([controller.signal, options.abortSignal]) : controller.signal;
+		const stdoutDecoder = new TextDecoder();
+		const stderrDecoder = new TextDecoder();
+		let stdout = "";
+		let stderr = "";
+		let exitCode = 1;
+		const env = Object.fromEntries(Object.entries({
+			...this.env,
+			...options?.env
+		}).filter((entry) => entry[1] !== void 0));
+		try {
+			await this.client.exec(sandboxId, {
+				argv: buildArgv(command, args, env),
+				timeoutMs: timeout,
+				cwd: options?.cwd ?? this.workingDirectory
+			}, {
+				signal,
+				onEvent: (event) => {
+					switch (event.type) {
+						case "stdout": {
+							const chunk = stdoutDecoder.decode(event.data, { stream: true });
+							if (!chunk) return;
+							stdout += chunk;
+							options?.onStdout?.(chunk);
+							return;
+						}
+						case "stderr": {
+							const chunk = stderrDecoder.decode(event.data, { stream: true });
+							if (!chunk) return;
+							stderr += chunk;
+							options?.onStderr?.(chunk);
+							return;
+						}
+						case "exit":
+							exitCode = event.exitCode;
+							return;
+						case "error":
+							stderr += event.message;
+							options?.onStderr?.(event.message);
+							return;
+					}
+				}
+			});
+		} catch (error) {
+			if (!signal.aborted) throw error;
+		} finally {
+			clearTimeout(timer);
+		}
+		const stdoutTail = stdoutDecoder.decode();
+		if (stdoutTail) {
+			stdout += stdoutTail;
+			options?.onStdout?.(stdoutTail);
+		}
+		const stderrTail = stderrDecoder.decode();
+		if (stderrTail) {
+			stderr += stderrTail;
+			options?.onStderr?.(stderrTail);
+		}
+		this.lastUsedAt = /* @__PURE__ */ new Date();
+		return {
+			command,
+			args,
+			success: exitCode === 0 && !signal.aborted,
+			exitCode,
+			stdout,
+			stderr,
+			executionTimeMs: Date.now() - startedAt,
+			timedOut: didTimeout,
+			killed: signal.aborted && !didTimeout
+		};
+	}
+	async writeFiles(files) {
+		const sandboxId = this.requireSandboxId();
+		for (const file of files) await this.client.writeFile(sandboxId, resolveWorkspacePath(file.path), file.content);
+		this.lastUsedAt = /* @__PURE__ */ new Date();
+	}
+	getInfo() {
+		return {
+			id: this.id,
+			name: this.name,
+			provider: this.provider,
+			status: this.status,
+			createdAt: this.createdAt,
+			lastUsedAt: this.lastUsedAt,
+			metadata: {
+				sandboxId: this.sandboxId,
+				bridgeBaseUrl: this.client instanceof CloudflareSandboxBridgeClient ? this.client.baseUrl : void 0
+			}
+		};
+	}
+	getInstructions() {
+		const defaultInstructions = "Commands execute in a remote Cloudflare Sandbox. Read and write persistent project files under /workspace.";
+		return typeof this.instructions === "function" ? this.instructions({ defaultInstructions }) : this.instructions ?? defaultInstructions;
+	}
+	requireSandboxId() {
+		if (!this.sandboxId) throw new Error(`Cloudflare Sandbox ${this.id} has not been started`);
+		return this.sandboxId;
+	}
+};
+//#endregion
+exports.CloudflareSandbox = CloudflareSandbox;
+exports.CloudflareSandboxBridgeClient = CloudflareSandboxBridgeClient;
+exports.CloudflareSandboxBridgeError = CloudflareSandboxBridgeError;
+
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["posix","path","MastraSandbox"],"sources":["../src/bridge-client.ts","../src/sandbox.ts"],"sourcesContent":["export interface CloudflareSandboxBridgeClientOptions {\n  baseUrl: string;\n  apiToken?: string;\n  fetch?: typeof globalThis.fetch;\n}\n\n/** Terminal and streaming events emitted by `POST /v1/sandbox/:id/exec`. */\nexport type CloudflareCommandEvent =\n  | { type: 'stdout'; data: Uint8Array }\n  | { type: 'stderr'; data: Uint8Array }\n  | { type: 'exit'; exitCode: number }\n  | { type: 'error'; message: string; code?: string };\n\nexport interface CloudflareExecRequest {\n  /** Command and arguments. The bridge applies ANSI-C quoting to each element. */\n  argv: string[];\n  timeoutMs?: number;\n  cwd?: string;\n}\n\nexport class CloudflareSandboxBridgeError extends Error {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(status: number, body: string) {\n    super(`Cloudflare Sandbox Bridge request failed (${status}): ${body || 'empty response'}`);\n    this.name = 'CloudflareSandboxBridgeError';\n    this.status = status;\n    this.body = body;\n  }\n}\n\nfunction stripTrailingSlashes(url: string): string {\n  let end = url.length;\n  while (end > 0 && url[end - 1] === '/') end--;\n  return url.slice(0, end);\n}\n\n/** Encodes an absolute sandbox path for the `/file/*` route, which omits the leading slash. */\nfunction encodeFilePath(absolutePath: string): string {\n  let start = 0;\n  while (start < absolutePath.length && absolutePath[start] === '/') start++;\n  return absolutePath\n    .slice(start)\n    .split('/')\n    .map(segment => encodeURIComponent(segment))\n    .join('/');\n}\n\n/**\n * Client for the Cloudflare Sandbox Bridge Worker.\n *\n * @see https://developers.cloudflare.com/sandbox/bridge/http-api/\n */\nexport class CloudflareSandboxBridgeClient {\n  readonly baseUrl: string;\n  private readonly apiToken?: string;\n  private readonly fetchImpl: typeof globalThis.fetch;\n\n  constructor(options: CloudflareSandboxBridgeClientOptions) {\n    this.baseUrl = stripTrailingSlashes(options.baseUrl);\n    this.apiToken = options.apiToken;\n    this.fetchImpl = options.fetch ?? globalThis.fetch;\n  }\n\n  /** `POST /v1/sandbox` */\n  async createSandbox(): Promise<string> {\n    const created = await this.request<{ id: string }>('/v1/sandbox', { method: 'POST' });\n    return created.id;\n  }\n\n  /** `GET /v1/sandbox/:id/running` */\n  async isRunning(id: string): Promise<boolean> {\n    const status = await this.request<{ running: boolean }>(`/v1/sandbox/${encodeURIComponent(id)}/running`, {});\n    return status.running === true;\n  }\n\n  /** `DELETE /v1/sandbox/:id` */\n  async deleteSandbox(id: string): Promise<void> {\n    await this.request(`/v1/sandbox/${encodeURIComponent(id)}`, { method: 'DELETE' }, true);\n  }\n\n  /** `PUT /v1/sandbox/:id/file/*` — one file per request, raw bytes as the body. */\n  async writeFile(id: string, absolutePath: string, content: Uint8Array | string): Promise<void> {\n    await this.request(\n      `/v1/sandbox/${encodeURIComponent(id)}/file/${encodeFilePath(absolutePath)}`,\n      {\n        method: 'PUT',\n        body: content as RequestInit['body'],\n        headers: { 'content-type': 'application/octet-stream' },\n      },\n      true,\n    );\n  }\n\n  /** `POST /v1/sandbox/:id/exec` — streams SSE events until `exit` or `error`. */\n  async exec(\n    id: string,\n    request: CloudflareExecRequest,\n    options: {\n      signal?: AbortSignal;\n      onEvent: (event: CloudflareCommandEvent) => void;\n    },\n  ): Promise<void> {\n    const response = await this.fetchImpl(`${this.baseUrl}/v1/sandbox/${encodeURIComponent(id)}/exec`, {\n      method: 'POST',\n      headers: { ...this.headers(), 'content-type': 'application/json', accept: 'text/event-stream' },\n      body: JSON.stringify({\n        argv: request.argv,\n        ...(request.timeoutMs === undefined ? {} : { timeout_ms: request.timeoutMs }),\n        ...(request.cwd === undefined ? {} : { cwd: request.cwd }),\n      }),\n      signal: options.signal,\n    });\n\n    if (!response.ok) {\n      throw new CloudflareSandboxBridgeError(response.status, await response.text());\n    }\n    if (!response.body) {\n      throw new Error('Cloudflare Sandbox Bridge returned an empty command stream');\n    }\n\n    const reader = response.body.getReader();\n    const decoder = new TextDecoder();\n    let buffer = '';\n\n    while (true) {\n      const { done, value } = await reader.read();\n      buffer += decoder.decode(value, { stream: !done }).replace(/\\r\\n/g, '\\n');\n      let boundary = buffer.indexOf('\\n\\n');\n      while (boundary !== -1) {\n        this.emitBlock(buffer.slice(0, boundary), options.onEvent);\n        buffer = buffer.slice(boundary + 2);\n        boundary = buffer.indexOf('\\n\\n');\n      }\n      if (done) break;\n    }\n    if (buffer.trim()) this.emitBlock(buffer, options.onEvent);\n  }\n\n  private emitBlock(block: string, onEvent: (event: CloudflareCommandEvent) => void): void {\n    let eventName: string | undefined;\n    const dataLines: string[] = [];\n    for (const line of block.split('\\n')) {\n      if (line.startsWith('event:')) eventName = line.slice(6).trim();\n      else if (line.startsWith('data:')) dataLines.push(line.slice(5).replace(/^ /, ''));\n    }\n    const data = dataLines.join('\\n');\n    if (!eventName || !data) return;\n\n    switch (eventName) {\n      case 'stdout':\n      case 'stderr':\n        onEvent({ type: eventName, data: base64ToBytes(data) });\n        return;\n      case 'exit': {\n        const parsed = safeJsonParse(data);\n        onEvent({ type: 'exit', exitCode: typeof parsed?.exit_code === 'number' ? parsed.exit_code : 0 });\n        return;\n      }\n      case 'error': {\n        const parsed = safeJsonParse(data);\n        onEvent({\n          type: 'error',\n          message: typeof parsed?.error === 'string' ? parsed.error : data,\n          code: typeof parsed?.code === 'string' ? parsed.code : undefined,\n        });\n        return;\n      }\n      default:\n        return;\n    }\n  }\n\n  private headers(): Record<string, string> {\n    return this.apiToken ? { authorization: `Bearer ${this.apiToken}` } : {};\n  }\n\n  private async request<T>(path: string, init: RequestInit, allowEmpty = false): Promise<T> {\n    const response = await this.fetchImpl(`${this.baseUrl}${path}`, {\n      ...init,\n      headers: { ...this.headers(), ...init.headers },\n    });\n    if (!response.ok) {\n      throw new CloudflareSandboxBridgeError(response.status, await response.text());\n    }\n    if (allowEmpty || response.status === 204) return undefined as T;\n    return response.json() as Promise<T>;\n  }\n}\n\nfunction base64ToBytes(value: string): Uint8Array {\n  return new Uint8Array(Buffer.from(value, 'base64'));\n}\n\nfunction safeJsonParse(value: string): Record<string, unknown> | undefined {\n  try {\n    return JSON.parse(value) as Record<string, unknown>;\n  } catch {\n    return undefined;\n  }\n}\n","import { randomUUID } from 'node:crypto';\nimport { posix } from 'node:path';\nimport type {\n  CommandResult,\n  ExecuteCommandOptions,\n  MastraSandboxOptions,\n  ProviderStatus,\n  SandboxFileInput,\n  SandboxInfo,\n} from '@mastra/core/workspace';\nimport { MastraSandbox } from '@mastra/core/workspace';\nimport { CloudflareSandboxBridgeClient, type CloudflareSandboxBridgeClientOptions } from './bridge-client';\n\nconst DEFAULT_COMMAND_TIMEOUT_MS = 300_000;\nconst WORKSPACE_ROOT = '/workspace';\n\ntype InstructionsOption = string | ((options: { defaultInstructions: string }) => string);\ntype BridgeClient = Pick<\n  CloudflareSandboxBridgeClient,\n  'createSandbox' | 'isRunning' | 'deleteSandbox' | 'writeFile' | 'exec'\n>;\n\nexport interface CloudflareSandboxOptions extends Omit<MastraSandboxOptions, 'processes'> {\n  /** URL of a deployed Cloudflare Sandbox Bridge Worker. */\n  baseUrl: string;\n  /** Bearer token matching the Worker's `SANDBOX_API_KEY` secret, when authentication is enabled. */\n  apiToken?: string;\n  /** Stable Mastra identifier for this sandbox instance. */\n  id?: string;\n  /** Existing Cloudflare sandbox ID to reconnect to instead of creating a sandbox. */\n  sandboxId?: string;\n  /** Human-readable name shown in Mastra sandbox metadata. */\n  name?: string;\n  /** Environment variables applied to every command. */\n  env?: Record<string, string>;\n  /** Working directory applied to every command. Must be under /workspace. */\n  workingDirectory?: string;\n  /** Default command timeout in milliseconds. */\n  commandTimeout?: number;\n  /** Custom instructions returned by getInstructions(). */\n  instructions?: InstructionsOption;\n  /** Custom fetch implementation, primarily for advanced networking setup and tests. */\n  fetch?: CloudflareSandboxBridgeClientOptions['fetch'];\n  /** Preconfigured Bridge client, primarily for tests. */\n  client?: BridgeClient;\n}\n\n/**\n * Builds the argv array sent to the bridge. The bridge applies ANSI-C quoting to\n * every element, so no local escaping is needed. Environment variables are applied\n * with `env`, which keeps each assignment a separate argv element.\n */\nfunction buildArgv(command: string, args: string[] | undefined, env: Record<string, string>): string[] {\n  const assignments = Object.entries(env).map(([key, value]) => {\n    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) throw new Error(`Invalid environment variable name: ${key}`);\n    return `${key}=${value}`;\n  });\n  const invocation = [command, ...(args ?? [])];\n  return assignments.length ? ['env', ...assignments, ...invocation] : invocation;\n}\n\n/** Resolves a path inside /workspace, rejecting anything that escapes the workspace root. */\nfunction resolveWorkspacePath(path: string): string {\n  const resolved = posix.resolve(WORKSPACE_ROOT, path);\n  if (resolved !== WORKSPACE_ROOT && !resolved.startsWith(`${WORKSPACE_ROOT}/`)) {\n    throw new Error(`Cloudflare Sandbox files must be written under ${WORKSPACE_ROOT}: ${path}`);\n  }\n  return resolved;\n}\n\nexport class CloudflareSandbox extends MastraSandbox {\n  readonly id: string;\n  readonly name: string;\n  readonly provider = 'cloudflare-sandbox';\n  status: ProviderStatus = 'pending';\n\n  private readonly client: BridgeClient;\n  private readonly env: Record<string, string>;\n  private readonly workingDirectory?: string;\n  private readonly commandTimeout: number;\n  private readonly instructions?: InstructionsOption;\n  private sandboxId?: string;\n  private createdAt = new Date();\n  private lastUsedAt?: Date;\n\n  constructor(options: CloudflareSandboxOptions) {\n    const name = options.name ?? 'Cloudflare Sandbox';\n    super({ ...options, name });\n    this.id = options.id ?? `cloudflare-sandbox-${randomUUID()}`;\n    this.name = name;\n    this.sandboxId = options.sandboxId;\n    this.env = { ...options.env };\n    this.workingDirectory = options.workingDirectory;\n    this.commandTimeout = options.commandTimeout ?? DEFAULT_COMMAND_TIMEOUT_MS;\n    this.instructions = options.instructions;\n    this.client =\n      options.client ??\n      new CloudflareSandboxBridgeClient({ baseUrl: options.baseUrl, apiToken: options.apiToken, fetch: options.fetch });\n  }\n\n  async start(): Promise<void> {\n    if (this.sandboxId) {\n      // The bridge boots the container on demand, so a stopped container is not fatal.\n      const running = await this.client.isRunning(this.sandboxId);\n      if (!running) {\n        this.logger?.debug(`Cloudflare sandbox ${this.sandboxId} is not running yet; it starts on first use`);\n      }\n      return;\n    }\n    this.sandboxId = await this.client.createSandbox();\n    this.createdAt = new Date();\n  }\n\n  async stop(): Promise<void> {\n    // The bridge exposes create/delete but no suspend operation. Stop detaches this\n    // Mastra lifecycle while preserving the remote sandbox for later reconnection.\n  }\n\n  async destroy(): Promise<void> {\n    if (!this.sandboxId) return;\n    await this.client.deleteSandbox(this.sandboxId);\n    this.sandboxId = undefined;\n  }\n\n  async executeCommand(command: string, args?: string[], options?: ExecuteCommandOptions): Promise<CommandResult> {\n    const sandboxId = this.requireSandboxId();\n\n    const startedAt = Date.now();\n    const timeout = options?.timeout ?? this.commandTimeout;\n    if (!Number.isFinite(timeout) || timeout <= 0) throw new RangeError('Command timeout must be positive');\n\n    const controller = new AbortController();\n    let didTimeout = false;\n    const timer = setTimeout(() => {\n      didTimeout = true;\n      controller.abort();\n    }, timeout);\n    const signal = options?.abortSignal ? AbortSignal.any([controller.signal, options.abortSignal]) : controller.signal;\n\n    // stdout and stderr are separate byte streams, so each needs its own streaming decoder.\n    const stdoutDecoder = new TextDecoder();\n    const stderrDecoder = new TextDecoder();\n    let stdout = '';\n    let stderr = '';\n    let exitCode = 1;\n\n    const env = Object.fromEntries(\n      Object.entries({ ...this.env, ...options?.env }).filter(\n        (entry): entry is [string, string] => entry[1] !== undefined,\n      ),\n    );\n\n    try {\n      await this.client.exec(\n        sandboxId,\n        {\n          argv: buildArgv(command, args, env),\n          timeoutMs: timeout,\n          cwd: options?.cwd ?? this.workingDirectory,\n        },\n        {\n          signal,\n          onEvent: event => {\n            switch (event.type) {\n              case 'stdout': {\n                const chunk = stdoutDecoder.decode(event.data, { stream: true });\n                if (!chunk) return;\n                stdout += chunk;\n                options?.onStdout?.(chunk);\n                return;\n              }\n              case 'stderr': {\n                const chunk = stderrDecoder.decode(event.data, { stream: true });\n                if (!chunk) return;\n                stderr += chunk;\n                options?.onStderr?.(chunk);\n                return;\n              }\n              case 'exit':\n                exitCode = event.exitCode;\n                return;\n              case 'error':\n                stderr += event.message;\n                options?.onStderr?.(event.message);\n                return;\n            }\n          },\n        },\n      );\n    } catch (error) {\n      if (!signal.aborted) throw error;\n    } finally {\n      clearTimeout(timer);\n    }\n\n    // Flush each decoder so a trailing truncated multi-byte sequence isn't dropped.\n    const stdoutTail = stdoutDecoder.decode();\n    if (stdoutTail) {\n      stdout += stdoutTail;\n      options?.onStdout?.(stdoutTail);\n    }\n    const stderrTail = stderrDecoder.decode();\n    if (stderrTail) {\n      stderr += stderrTail;\n      options?.onStderr?.(stderrTail);\n    }\n\n    this.lastUsedAt = new Date();\n    return {\n      command,\n      args,\n      success: exitCode === 0 && !signal.aborted,\n      exitCode,\n      stdout,\n      stderr,\n      executionTimeMs: Date.now() - startedAt,\n      timedOut: didTimeout,\n      killed: signal.aborted && !didTimeout,\n    };\n  }\n\n  async writeFiles(files: SandboxFileInput[]): Promise<void> {\n    const sandboxId = this.requireSandboxId();\n    // The bridge writes one file per request.\n    for (const file of files) {\n      await this.client.writeFile(sandboxId, resolveWorkspacePath(file.path), file.content);\n    }\n    this.lastUsedAt = new Date();\n  }\n\n  getInfo(): SandboxInfo {\n    return {\n      id: this.id,\n      name: this.name,\n      provider: this.provider,\n      status: this.status,\n      createdAt: this.createdAt,\n      lastUsedAt: this.lastUsedAt,\n      metadata: {\n        sandboxId: this.sandboxId,\n        bridgeBaseUrl: this.client instanceof CloudflareSandboxBridgeClient ? this.client.baseUrl : undefined,\n      },\n    };\n  }\n\n  getInstructions(): string {\n    const defaultInstructions =\n      'Commands execute in a remote Cloudflare Sandbox. Read and write persistent project files under /workspace.';\n    return typeof this.instructions === 'function'\n      ? this.instructions({ defaultInstructions })\n      : (this.instructions ?? defaultInstructions);\n  }\n\n  private requireSandboxId(): string {\n    if (!this.sandboxId) throw new Error(`Cloudflare Sandbox ${this.id} has not been started`);\n    return this.sandboxId;\n  }\n}\n"],"mappings":";;;;;AAoBA,IAAa,+BAAb,cAAkD,MAAM;CACtD;CACA;CAEA,YAAY,QAAgB,MAAc;EACxC,MAAM,6CAA6C,OAAO,KAAK,QAAQ,kBAAkB;EACzF,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;CACd;AACF;AAEA,SAAS,qBAAqB,KAAqB;CACjD,IAAI,MAAM,IAAI;CACd,OAAO,MAAM,KAAK,IAAI,MAAM,OAAO,KAAK;CACxC,OAAO,IAAI,MAAM,GAAG,GAAG;AACzB;;AAGA,SAAS,eAAe,cAA8B;CACpD,IAAI,QAAQ;CACZ,OAAO,QAAQ,aAAa,UAAU,aAAa,WAAW,KAAK;CACnE,OAAO,aACJ,MAAM,KAAK,CAAC,CACZ,MAAM,GAAG,CAAC,CACV,KAAI,YAAW,mBAAmB,OAAO,CAAC,CAAC,CAC3C,KAAK,GAAG;AACb;;;;;;AAOA,IAAa,gCAAb,MAA2C;CACzC;CACA;CACA;CAEA,YAAY,SAA+C;EACzD,KAAK,UAAU,qBAAqB,QAAQ,OAAO;EACnD,KAAK,WAAW,QAAQ;EACxB,KAAK,YAAY,QAAQ,SAAS,WAAW;CAC/C;;CAGA,MAAM,gBAAiC;EAErC,QAAO,MADe,KAAK,QAAwB,eAAe,EAAE,QAAQ,OAAO,CAAC,EAAA,CACrE;CACjB;;CAGA,MAAM,UAAU,IAA8B;EAE5C,QAAO,MADc,KAAK,QAA8B,eAAe,mBAAmB,EAAE,EAAE,WAAW,CAAC,CAAC,EAAA,CAC7F,YAAY;CAC5B;;CAGA,MAAM,cAAc,IAA2B;EAC7C,MAAM,KAAK,QAAQ,eAAe,mBAAmB,EAAE,KAAK,EAAE,QAAQ,SAAS,GAAG,IAAI;CACxF;;CAGA,MAAM,UAAU,IAAY,cAAsB,SAA6C;EAC7F,MAAM,KAAK,QACT,eAAe,mBAAmB,EAAE,EAAE,QAAQ,eAAe,YAAY,KACzE;GACE,QAAQ;GACR,MAAM;GACN,SAAS,EAAE,gBAAgB,2BAA2B;EACxD,GACA,IACF;CACF;;CAGA,MAAM,KACJ,IACA,SACA,SAIe;EACf,MAAM,WAAW,MAAM,KAAK,UAAU,GAAG,KAAK,QAAQ,cAAc,mBAAmB,EAAE,EAAE,QAAQ;GACjG,QAAQ;GACR,SAAS;IAAE,GAAG,KAAK,QAAQ;IAAG,gBAAgB;IAAoB,QAAQ;GAAoB;GAC9F,MAAM,KAAK,UAAU;IACnB,MAAM,QAAQ;IACd,GAAI,QAAQ,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,UAAU;IAC3E,GAAI,QAAQ,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,QAAQ,IAAI;GAC1D,CAAC;GACD,QAAQ,QAAQ;EAClB,CAAC;EAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,6BAA6B,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAE/E,IAAI,CAAC,SAAS,MACZ,MAAM,IAAI,MAAM,4DAA4D;EAG9E,MAAM,SAAS,SAAS,KAAK,UAAU;EACvC,MAAM,UAAU,IAAI,YAAY;EAChC,IAAI,SAAS;EAEb,OAAO,MAAM;GACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;GAC1C,UAAU,QAAQ,OAAO,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,SAAS,IAAI;GACxE,IAAI,WAAW,OAAO,QAAQ,MAAM;GACpC,OAAO,aAAa,IAAI;IACtB,KAAK,UAAU,OAAO,MAAM,GAAG,QAAQ,GAAG,QAAQ,OAAO;IACzD,SAAS,OAAO,MAAM,WAAW,CAAC;IAClC,WAAW,OAAO,QAAQ,MAAM;GAClC;GACA,IAAI,MAAM;EACZ;EACA,IAAI,OAAO,KAAK,GAAG,KAAK,UAAU,QAAQ,QAAQ,OAAO;CAC3D;CAEA,UAAkB,OAAe,SAAwD;EACvF,IAAI;EACJ,MAAM,YAAsB,CAAC;EAC7B,KAAK,MAAM,QAAQ,MAAM,MAAM,IAAI,GACjC,IAAI,KAAK,WAAW,QAAQ,GAAG,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK;OACzD,IAAI,KAAK,WAAW,OAAO,GAAG,UAAU,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC;EAEnF,MAAM,OAAO,UAAU,KAAK,IAAI;EAChC,IAAI,CAAC,aAAa,CAAC,MAAM;EAEzB,QAAQ,WAAR;GACE,KAAK;GACL,KAAK;IACH,QAAQ;KAAE,MAAM;KAAW,MAAM,cAAc,IAAI;IAAE,CAAC;IACtD;GACF,KAAK,QAAQ;IACX,MAAM,SAAS,cAAc,IAAI;IACjC,QAAQ;KAAE,MAAM;KAAQ,UAAU,OAAO,QAAQ,cAAc,WAAW,OAAO,YAAY;IAAE,CAAC;IAChG;GACF;GACA,KAAK,SAAS;IACZ,MAAM,SAAS,cAAc,IAAI;IACjC,QAAQ;KACN,MAAM;KACN,SAAS,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ;KAC5D,MAAM,OAAO,QAAQ,SAAS,WAAW,OAAO,OAAO,KAAA;IACzD,CAAC;IACD;GACF;GACA,SACE;EACJ;CACF;CAEA,UAA0C;EACxC,OAAO,KAAK,WAAW,EAAE,eAAe,UAAU,KAAK,WAAW,IAAI,CAAC;CACzE;CAEA,MAAc,QAAW,MAAc,MAAmB,aAAa,OAAmB;EACxF,MAAM,WAAW,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,QAAQ;GAC9D,GAAG;GACH,SAAS;IAAE,GAAG,KAAK,QAAQ;IAAG,GAAG,KAAK;GAAQ;EAChD,CAAC;EACD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,6BAA6B,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAE/E,IAAI,cAAc,SAAS,WAAW,KAAK,OAAO,KAAA;EAClD,OAAO,SAAS,KAAK;CACvB;AACF;AAEA,SAAS,cAAc,OAA2B;CAChD,OAAO,IAAI,WAAW,OAAO,KAAK,OAAO,QAAQ,CAAC;AACpD;AAEA,SAAS,cAAc,OAAoD;CACzE,IAAI;EACF,OAAO,KAAK,MAAM,KAAK;CACzB,QAAQ;EACN;CACF;AACF;;;AC5LA,MAAM,6BAA6B;AACnC,MAAM,iBAAiB;;;;;;AAsCvB,SAAS,UAAU,SAAiB,MAA4B,KAAuC;CACrG,MAAM,cAAc,OAAO,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;EAC5D,IAAI,CAAC,2BAA2B,KAAK,GAAG,GAAG,MAAM,IAAI,MAAM,sCAAsC,KAAK;EACtG,OAAO,GAAG,IAAI,GAAG;CACnB,CAAC;CACD,MAAM,aAAa,CAAC,SAAS,GAAI,QAAQ,CAAC,CAAE;CAC5C,OAAO,YAAY,SAAS;EAAC;EAAO,GAAG;EAAa,GAAG;CAAU,IAAI;AACvE;;AAGA,SAAS,qBAAqB,QAAsB;CAClD,MAAM,WAAWA,KAAAA,MAAM,QAAQ,gBAAgBC,MAAI;CACnD,IAAI,aAAa,kBAAkB,CAAC,SAAS,WAAW,GAAG,eAAe,EAAE,GAC1E,MAAM,IAAI,MAAM,kDAAkD,eAAe,IAAIA,QAAM;CAE7F,OAAO;AACT;AAEA,IAAa,oBAAb,cAAuCC,uBAAAA,cAAc;CACnD;CACA;CACA,WAAoB;CACpB,SAAyB;CAEzB;CACA;CACA;CACA;CACA;CACA;CACA,4BAAoB,IAAI,KAAK;CAC7B;CAEA,YAAY,SAAmC;EAC7C,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM;GAAE,GAAG;GAAS;EAAK,CAAC;EAC1B,KAAK,KAAK,QAAQ,MAAM,uBAAA,GAAA,OAAA,WAAA,CAAiC;EACzD,KAAK,OAAO;EACZ,KAAK,YAAY,QAAQ;EACzB,KAAK,MAAM,EAAE,GAAG,QAAQ,IAAI;EAC5B,KAAK,mBAAmB,QAAQ;EAChC,KAAK,iBAAiB,QAAQ,kBAAkB;EAChD,KAAK,eAAe,QAAQ;EAC5B,KAAK,SACH,QAAQ,UACR,IAAI,8BAA8B;GAAE,SAAS,QAAQ;GAAS,UAAU,QAAQ;GAAU,OAAO,QAAQ;EAAM,CAAC;CACpH;CAEA,MAAM,QAAuB;EAC3B,IAAI,KAAK,WAAW;GAGlB,IAAI,CAAC,MADiB,KAAK,OAAO,UAAU,KAAK,SAAS,GAExD,KAAK,QAAQ,MAAM,sBAAsB,KAAK,UAAU,4CAA4C;GAEtG;EACF;EACA,KAAK,YAAY,MAAM,KAAK,OAAO,cAAc;EACjD,KAAK,4BAAY,IAAI,KAAK;CAC5B;CAEA,MAAM,OAAsB,CAG5B;CAEA,MAAM,UAAyB;EAC7B,IAAI,CAAC,KAAK,WAAW;EACrB,MAAM,KAAK,OAAO,cAAc,KAAK,SAAS;EAC9C,KAAK,YAAY,KAAA;CACnB;CAEA,MAAM,eAAe,SAAiB,MAAiB,SAAyD;EAC9G,MAAM,YAAY,KAAK,iBAAiB;EAExC,MAAM,YAAY,KAAK,IAAI;EAC3B,MAAM,UAAU,SAAS,WAAW,KAAK;EACzC,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,WAAW,GAAG,MAAM,IAAI,WAAW,kCAAkC;EAEtG,MAAM,aAAa,IAAI,gBAAgB;EACvC,IAAI,aAAa;EACjB,MAAM,QAAQ,iBAAiB;GAC7B,aAAa;GACb,WAAW,MAAM;EACnB,GAAG,OAAO;EACV,MAAM,SAAS,SAAS,cAAc,YAAY,IAAI,CAAC,WAAW,QAAQ,QAAQ,WAAW,CAAC,IAAI,WAAW;EAG7G,MAAM,gBAAgB,IAAI,YAAY;EACtC,MAAM,gBAAgB,IAAI,YAAY;EACtC,IAAI,SAAS;EACb,IAAI,SAAS;EACb,IAAI,WAAW;EAEf,MAAM,MAAM,OAAO,YACjB,OAAO,QAAQ;GAAE,GAAG,KAAK;GAAK,GAAG,SAAS;EAAI,CAAC,CAAC,CAAC,QAC9C,UAAqC,MAAM,OAAO,KAAA,CACrD,CACF;EAEA,IAAI;GACF,MAAM,KAAK,OAAO,KAChB,WACA;IACE,MAAM,UAAU,SAAS,MAAM,GAAG;IAClC,WAAW;IACX,KAAK,SAAS,OAAO,KAAK;GAC5B,GACA;IACE;IACA,UAAS,UAAS;KAChB,QAAQ,MAAM,MAAd;MACE,KAAK,UAAU;OACb,MAAM,QAAQ,cAAc,OAAO,MAAM,MAAM,EAAE,QAAQ,KAAK,CAAC;OAC/D,IAAI,CAAC,OAAO;OACZ,UAAU;OACV,SAAS,WAAW,KAAK;OACzB;MACF;MACA,KAAK,UAAU;OACb,MAAM,QAAQ,cAAc,OAAO,MAAM,MAAM,EAAE,QAAQ,KAAK,CAAC;OAC/D,IAAI,CAAC,OAAO;OACZ,UAAU;OACV,SAAS,WAAW,KAAK;OACzB;MACF;MACA,KAAK;OACH,WAAW,MAAM;OACjB;MACF,KAAK;OACH,UAAU,MAAM;OAChB,SAAS,WAAW,MAAM,OAAO;OACjC;KACJ;IACF;GACF,CACF;EACF,SAAS,OAAO;GACd,IAAI,CAAC,OAAO,SAAS,MAAM;EAC7B,UAAU;GACR,aAAa,KAAK;EACpB;EAGA,MAAM,aAAa,cAAc,OAAO;EACxC,IAAI,YAAY;GACd,UAAU;GACV,SAAS,WAAW,UAAU;EAChC;EACA,MAAM,aAAa,cAAc,OAAO;EACxC,IAAI,YAAY;GACd,UAAU;GACV,SAAS,WAAW,UAAU;EAChC;EAEA,KAAK,6BAAa,IAAI,KAAK;EAC3B,OAAO;GACL;GACA;GACA,SAAS,aAAa,KAAK,CAAC,OAAO;GACnC;GACA;GACA;GACA,iBAAiB,KAAK,IAAI,IAAI;GAC9B,UAAU;GACV,QAAQ,OAAO,WAAW,CAAC;EAC7B;CACF;CAEA,MAAM,WAAW,OAA0C;EACzD,MAAM,YAAY,KAAK,iBAAiB;EAExC,KAAK,MAAM,QAAQ,OACjB,MAAM,KAAK,OAAO,UAAU,WAAW,qBAAqB,KAAK,IAAI,GAAG,KAAK,OAAO;EAEtF,KAAK,6BAAa,IAAI,KAAK;CAC7B;CAEA,UAAuB;EACrB,OAAO;GACL,IAAI,KAAK;GACT,MAAM,KAAK;GACX,UAAU,KAAK;GACf,QAAQ,KAAK;GACb,WAAW,KAAK;GAChB,YAAY,KAAK;GACjB,UAAU;IACR,WAAW,KAAK;IAChB,eAAe,KAAK,kBAAkB,gCAAgC,KAAK,OAAO,UAAU,KAAA;GAC9F;EACF;CACF;CAEA,kBAA0B;EACxB,MAAM,sBACJ;EACF,OAAO,OAAO,KAAK,iBAAiB,aAChC,KAAK,aAAa,EAAE,oBAAoB,CAAC,IACxC,KAAK,gBAAgB;CAC5B;CAEA,mBAAmC;EACjC,IAAI,CAAC,KAAK,WAAW,MAAM,IAAI,MAAM,sBAAsB,KAAK,GAAG,sBAAsB;EACzF,OAAO,KAAK;CACd;AACF"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { CloudflareSandboxBridgeClient, CloudflareSandboxBridgeError, type CloudflareCommandEvent, type CloudflareExecRequest, type CloudflareSandboxBridgeClientOptions, } from './bridge-client.js';
+export { CloudflareSandbox, type CloudflareSandboxOptions } from './sandbox.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,oCAAoC,GAC1C,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,KAAK,wBAAwB,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,341 @@
+import { randomUUID } from "crypto";
+import { posix } from "path";
+import { MastraSandbox } from "@mastra/core/workspace";
+//#region src/bridge-client.ts
+var CloudflareSandboxBridgeError = class extends Error {
+	status;
+	body;
+	constructor(status, body) {
+		super(`Cloudflare Sandbox Bridge request failed (${status}): ${body || "empty response"}`);
+		this.name = "CloudflareSandboxBridgeError";
+		this.status = status;
+		this.body = body;
+	}
+};
+function stripTrailingSlashes(url) {
+	let end = url.length;
+	while (end > 0 && url[end - 1] === "/") end--;
+	return url.slice(0, end);
+}
+/** Encodes an absolute sandbox path for the `/file/*` route, which omits the leading slash. */
+function encodeFilePath(absolutePath) {
+	let start = 0;
+	while (start < absolutePath.length && absolutePath[start] === "/") start++;
+	return absolutePath.slice(start).split("/").map((segment) => encodeURIComponent(segment)).join("/");
+}
+/**
+* Client for the Cloudflare Sandbox Bridge Worker.
+*
+* @see https://developers.cloudflare.com/sandbox/bridge/http-api/
+*/
+var CloudflareSandboxBridgeClient = class {
+	baseUrl;
+	apiToken;
+	fetchImpl;
+	constructor(options) {
+		this.baseUrl = stripTrailingSlashes(options.baseUrl);
+		this.apiToken = options.apiToken;
+		this.fetchImpl = options.fetch ?? globalThis.fetch;
+	}
+	/** `POST /v1/sandbox` */
+	async createSandbox() {
+		return (await this.request("/v1/sandbox", { method: "POST" })).id;
+	}
+	/** `GET /v1/sandbox/:id/running` */
+	async isRunning(id) {
+		return (await this.request(`/v1/sandbox/${encodeURIComponent(id)}/running`, {})).running === true;
+	}
+	/** `DELETE /v1/sandbox/:id` */
+	async deleteSandbox(id) {
+		await this.request(`/v1/sandbox/${encodeURIComponent(id)}`, { method: "DELETE" }, true);
+	}
+	/** `PUT /v1/sandbox/:id/file/*` — one file per request, raw bytes as the body. */
+	async writeFile(id, absolutePath, content) {
+		await this.request(`/v1/sandbox/${encodeURIComponent(id)}/file/${encodeFilePath(absolutePath)}`, {
+			method: "PUT",
+			body: content,
+			headers: { "content-type": "application/octet-stream" }
+		}, true);
+	}
+	/** `POST /v1/sandbox/:id/exec` — streams SSE events until `exit` or `error`. */
+	async exec(id, request, options) {
+		const response = await this.fetchImpl(`${this.baseUrl}/v1/sandbox/${encodeURIComponent(id)}/exec`, {
+			method: "POST",
+			headers: {
+				...this.headers(),
+				"content-type": "application/json",
+				accept: "text/event-stream"
+			},
+			body: JSON.stringify({
+				argv: request.argv,
+				...request.timeoutMs === void 0 ? {} : { timeout_ms: request.timeoutMs },
+				...request.cwd === void 0 ? {} : { cwd: request.cwd }
+			}),
+			signal: options.signal
+		});
+		if (!response.ok) throw new CloudflareSandboxBridgeError(response.status, await response.text());
+		if (!response.body) throw new Error("Cloudflare Sandbox Bridge returned an empty command stream");
+		const reader = response.body.getReader();
+		const decoder = new TextDecoder();
+		let buffer = "";
+		while (true) {
+			const { done, value } = await reader.read();
+			buffer += decoder.decode(value, { stream: !done }).replace(/\r\n/g, "\n");
+			let boundary = buffer.indexOf("\n\n");
+			while (boundary !== -1) {
+				this.emitBlock(buffer.slice(0, boundary), options.onEvent);
+				buffer = buffer.slice(boundary + 2);
+				boundary = buffer.indexOf("\n\n");
+			}
+			if (done) break;
+		}
+		if (buffer.trim()) this.emitBlock(buffer, options.onEvent);
+	}
+	emitBlock(block, onEvent) {
+		let eventName;
+		const dataLines = [];
+		for (const line of block.split("\n")) if (line.startsWith("event:")) eventName = line.slice(6).trim();
+		else if (line.startsWith("data:")) dataLines.push(line.slice(5).replace(/^ /, ""));
+		const data = dataLines.join("\n");
+		if (!eventName || !data) return;
+		switch (eventName) {
+			case "stdout":
+			case "stderr":
+				onEvent({
+					type: eventName,
+					data: base64ToBytes(data)
+				});
+				return;
+			case "exit": {
+				const parsed = safeJsonParse(data);
+				onEvent({
+					type: "exit",
+					exitCode: typeof parsed?.exit_code === "number" ? parsed.exit_code : 0
+				});
+				return;
+			}
+			case "error": {
+				const parsed = safeJsonParse(data);
+				onEvent({
+					type: "error",
+					message: typeof parsed?.error === "string" ? parsed.error : data,
+					code: typeof parsed?.code === "string" ? parsed.code : void 0
+				});
+				return;
+			}
+			default: return;
+		}
+	}
+	headers() {
+		return this.apiToken ? { authorization: `Bearer ${this.apiToken}` } : {};
+	}
+	async request(path, init, allowEmpty = false) {
+		const response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+			...init,
+			headers: {
+				...this.headers(),
+				...init.headers
+			}
+		});
+		if (!response.ok) throw new CloudflareSandboxBridgeError(response.status, await response.text());
+		if (allowEmpty || response.status === 204) return void 0;
+		return response.json();
+	}
+};
+function base64ToBytes(value) {
+	return new Uint8Array(Buffer.from(value, "base64"));
+}
+function safeJsonParse(value) {
+	try {
+		return JSON.parse(value);
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/sandbox.ts
+const DEFAULT_COMMAND_TIMEOUT_MS = 3e5;
+const WORKSPACE_ROOT = "/workspace";
+/**
+* Builds the argv array sent to the bridge. The bridge applies ANSI-C quoting to
+* every element, so no local escaping is needed. Environment variables are applied
+* with `env`, which keeps each assignment a separate argv element.
+*/
+function buildArgv(command, args, env) {
+	const assignments = Object.entries(env).map(([key, value]) => {
+		if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) throw new Error(`Invalid environment variable name: ${key}`);
+		return `${key}=${value}`;
+	});
+	const invocation = [command, ...args ?? []];
+	return assignments.length ? [
+		"env",
+		...assignments,
+		...invocation
+	] : invocation;
+}
+/** Resolves a path inside /workspace, rejecting anything that escapes the workspace root. */
+function resolveWorkspacePath(path) {
+	const resolved = posix.resolve(WORKSPACE_ROOT, path);
+	if (resolved !== WORKSPACE_ROOT && !resolved.startsWith(`${WORKSPACE_ROOT}/`)) throw new Error(`Cloudflare Sandbox files must be written under ${WORKSPACE_ROOT}: ${path}`);
+	return resolved;
+}
+var CloudflareSandbox = class extends MastraSandbox {
+	id;
+	name;
+	provider = "cloudflare-sandbox";
+	status = "pending";
+	client;
+	env;
+	workingDirectory;
+	commandTimeout;
+	instructions;
+	sandboxId;
+	createdAt = /* @__PURE__ */ new Date();
+	lastUsedAt;
+	constructor(options) {
+		const name = options.name ?? "Cloudflare Sandbox";
+		super({
+			...options,
+			name
+		});
+		this.id = options.id ?? `cloudflare-sandbox-${randomUUID()}`;
+		this.name = name;
+		this.sandboxId = options.sandboxId;
+		this.env = { ...options.env };
+		this.workingDirectory = options.workingDirectory;
+		this.commandTimeout = options.commandTimeout ?? DEFAULT_COMMAND_TIMEOUT_MS;
+		this.instructions = options.instructions;
+		this.client = options.client ?? new CloudflareSandboxBridgeClient({
+			baseUrl: options.baseUrl,
+			apiToken: options.apiToken,
+			fetch: options.fetch
+		});
+	}
+	async start() {
+		if (this.sandboxId) {
+			if (!await this.client.isRunning(this.sandboxId)) this.logger?.debug(`Cloudflare sandbox ${this.sandboxId} is not running yet; it starts on first use`);
+			return;
+		}
+		this.sandboxId = await this.client.createSandbox();
+		this.createdAt = /* @__PURE__ */ new Date();
+	}
+	async stop() {}
+	async destroy() {
+		if (!this.sandboxId) return;
+		await this.client.deleteSandbox(this.sandboxId);
+		this.sandboxId = void 0;
+	}
+	async executeCommand(command, args, options) {
+		const sandboxId = this.requireSandboxId();
+		const startedAt = Date.now();
+		const timeout = options?.timeout ?? this.commandTimeout;
+		if (!Number.isFinite(timeout) || timeout <= 0) throw new RangeError("Command timeout must be positive");
+		const controller = new AbortController();
+		let didTimeout = false;
+		const timer = setTimeout(() => {
+			didTimeout = true;
+			controller.abort();
+		}, timeout);
+		const signal = options?.abortSignal ? AbortSignal.any([controller.signal, options.abortSignal]) : controller.signal;
+		const stdoutDecoder = new TextDecoder();
+		const stderrDecoder = new TextDecoder();
+		let stdout = "";
+		let stderr = "";
+		let exitCode = 1;
+		const env = Object.fromEntries(Object.entries({
+			...this.env,
+			...options?.env
+		}).filter((entry) => entry[1] !== void 0));
+		try {
+			await this.client.exec(sandboxId, {
+				argv: buildArgv(command, args, env),
+				timeoutMs: timeout,
+				cwd: options?.cwd ?? this.workingDirectory
+			}, {
+				signal,
+				onEvent: (event) => {
+					switch (event.type) {
+						case "stdout": {
+							const chunk = stdoutDecoder.decode(event.data, { stream: true });
+							if (!chunk) return;
+							stdout += chunk;
+							options?.onStdout?.(chunk);
+							return;
+						}
+						case "stderr": {
+							const chunk = stderrDecoder.decode(event.data, { stream: true });
+							if (!chunk) return;
+							stderr += chunk;
+							options?.onStderr?.(chunk);
+							return;
+						}
+						case "exit":
+							exitCode = event.exitCode;
+							return;
+						case "error":
+							stderr += event.message;
+							options?.onStderr?.(event.message);
+							return;
+					}
+				}
+			});
+		} catch (error) {
+			if (!signal.aborted) throw error;
+		} finally {
+			clearTimeout(timer);
+		}
+		const stdoutTail = stdoutDecoder.decode();
+		if (stdoutTail) {
+			stdout += stdoutTail;
+			options?.onStdout?.(stdoutTail);
+		}
+		const stderrTail = stderrDecoder.decode();
+		if (stderrTail) {
+			stderr += stderrTail;
+			options?.onStderr?.(stderrTail);
+		}
+		this.lastUsedAt = /* @__PURE__ */ new Date();
+		return {
+			command,
+			args,
+			success: exitCode === 0 && !signal.aborted,
+			exitCode,
+			stdout,
+			stderr,
+			executionTimeMs: Date.now() - startedAt,
+			timedOut: didTimeout,
+			killed: signal.aborted && !didTimeout
+		};
+	}
+	async writeFiles(files) {
+		const sandboxId = this.requireSandboxId();
+		for (const file of files) await this.client.writeFile(sandboxId, resolveWorkspacePath(file.path), file.content);
+		this.lastUsedAt = /* @__PURE__ */ new Date();
+	}
+	getInfo() {
+		return {
+			id: this.id,
+			name: this.name,
+			provider: this.provider,
+			status: this.status,
+			createdAt: this.createdAt,
+			lastUsedAt: this.lastUsedAt,
+			metadata: {
+				sandboxId: this.sandboxId,
+				bridgeBaseUrl: this.client instanceof CloudflareSandboxBridgeClient ? this.client.baseUrl : void 0
+			}
+		};
+	}
+	getInstructions() {
+		const defaultInstructions = "Commands execute in a remote Cloudflare Sandbox. Read and write persistent project files under /workspace.";
+		return typeof this.instructions === "function" ? this.instructions({ defaultInstructions }) : this.instructions ?? defaultInstructions;
+	}
+	requireSandboxId() {
+		if (!this.sandboxId) throw new Error(`Cloudflare Sandbox ${this.id} has not been started`);
+		return this.sandboxId;
+	}
+};
+//#endregion
+export { CloudflareSandbox, CloudflareSandboxBridgeClient, CloudflareSandboxBridgeError };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/bridge-client.ts","../src/sandbox.ts"],"sourcesContent":["export interface CloudflareSandboxBridgeClientOptions {\n  baseUrl: string;\n  apiToken?: string;\n  fetch?: typeof globalThis.fetch;\n}\n\n/** Terminal and streaming events emitted by `POST /v1/sandbox/:id/exec`. */\nexport type CloudflareCommandEvent =\n  | { type: 'stdout'; data: Uint8Array }\n  | { type: 'stderr'; data: Uint8Array }\n  | { type: 'exit'; exitCode: number }\n  | { type: 'error'; message: string; code?: string };\n\nexport interface CloudflareExecRequest {\n  /** Command and arguments. The bridge applies ANSI-C quoting to each element. */\n  argv: string[];\n  timeoutMs?: number;\n  cwd?: string;\n}\n\nexport class CloudflareSandboxBridgeError extends Error {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(status: number, body: string) {\n    super(`Cloudflare Sandbox Bridge request failed (${status}): ${body || 'empty response'}`);\n    this.name = 'CloudflareSandboxBridgeError';\n    this.status = status;\n    this.body = body;\n  }\n}\n\nfunction stripTrailingSlashes(url: string): string {\n  let end = url.length;\n  while (end > 0 && url[end - 1] === '/') end--;\n  return url.slice(0, end);\n}\n\n/** Encodes an absolute sandbox path for the `/file/*` route, which omits the leading slash. */\nfunction encodeFilePath(absolutePath: string): string {\n  let start = 0;\n  while (start < absolutePath.length && absolutePath[start] === '/') start++;\n  return absolutePath\n    .slice(start)\n    .split('/')\n    .map(segment => encodeURIComponent(segment))\n    .join('/');\n}\n\n/**\n * Client for the Cloudflare Sandbox Bridge Worker.\n *\n * @see https://developers.cloudflare.com/sandbox/bridge/http-api/\n */\nexport class CloudflareSandboxBridgeClient {\n  readonly baseUrl: string;\n  private readonly apiToken?: string;\n  private readonly fetchImpl: typeof globalThis.fetch;\n\n  constructor(options: CloudflareSandboxBridgeClientOptions) {\n    this.baseUrl = stripTrailingSlashes(options.baseUrl);\n    this.apiToken = options.apiToken;\n    this.fetchImpl = options.fetch ?? globalThis.fetch;\n  }\n\n  /** `POST /v1/sandbox` */\n  async createSandbox(): Promise<string> {\n    const created = await this.request<{ id: string }>('/v1/sandbox', { method: 'POST' });\n    return created.id;\n  }\n\n  /** `GET /v1/sandbox/:id/running` */\n  async isRunning(id: string): Promise<boolean> {\n    const status = await this.request<{ running: boolean }>(`/v1/sandbox/${encodeURIComponent(id)}/running`, {});\n    return status.running === true;\n  }\n\n  /** `DELETE /v1/sandbox/:id` */\n  async deleteSandbox(id: string): Promise<void> {\n    await this.request(`/v1/sandbox/${encodeURIComponent(id)}`, { method: 'DELETE' }, true);\n  }\n\n  /** `PUT /v1/sandbox/:id/file/*` — one file per request, raw bytes as the body. */\n  async writeFile(id: string, absolutePath: string, content: Uint8Array | string): Promise<void> {\n    await this.request(\n      `/v1/sandbox/${encodeURIComponent(id)}/file/${encodeFilePath(absolutePath)}`,\n      {\n        method: 'PUT',\n        body: content as RequestInit['body'],\n        headers: { 'content-type': 'application/octet-stream' },\n      },\n      true,\n    );\n  }\n\n  /** `POST /v1/sandbox/:id/exec` — streams SSE events until `exit` or `error`. */\n  async exec(\n    id: string,\n    request: CloudflareExecRequest,\n    options: {\n      signal?: AbortSignal;\n      onEvent: (event: CloudflareCommandEvent) => void;\n    },\n  ): Promise<void> {\n    const response = await this.fetchImpl(`${this.baseUrl}/v1/sandbox/${encodeURIComponent(id)}/exec`, {\n      method: 'POST',\n      headers: { ...this.headers(), 'content-type': 'application/json', accept: 'text/event-stream' },\n      body: JSON.stringify({\n        argv: request.argv,\n        ...(request.timeoutMs === undefined ? {} : { timeout_ms: request.timeoutMs }),\n        ...(request.cwd === undefined ? {} : { cwd: request.cwd }),\n      }),\n      signal: options.signal,\n    });\n\n    if (!response.ok) {\n      throw new CloudflareSandboxBridgeError(response.status, await response.text());\n    }\n    if (!response.body) {\n      throw new Error('Cloudflare Sandbox Bridge returned an empty command stream');\n    }\n\n    const reader = response.body.getReader();\n    const decoder = new TextDecoder();\n    let buffer = '';\n\n    while (true) {\n      const { done, value } = await reader.read();\n      buffer += decoder.decode(value, { stream: !done }).replace(/\\r\\n/g, '\\n');\n      let boundary = buffer.indexOf('\\n\\n');\n      while (boundary !== -1) {\n        this.emitBlock(buffer.slice(0, boundary), options.onEvent);\n        buffer = buffer.slice(boundary + 2);\n        boundary = buffer.indexOf('\\n\\n');\n      }\n      if (done) break;\n    }\n    if (buffer.trim()) this.emitBlock(buffer, options.onEvent);\n  }\n\n  private emitBlock(block: string, onEvent: (event: CloudflareCommandEvent) => void): void {\n    let eventName: string | undefined;\n    const dataLines: string[] = [];\n    for (const line of block.split('\\n')) {\n      if (line.startsWith('event:')) eventName = line.slice(6).trim();\n      else if (line.startsWith('data:')) dataLines.push(line.slice(5).replace(/^ /, ''));\n    }\n    const data = dataLines.join('\\n');\n    if (!eventName || !data) return;\n\n    switch (eventName) {\n      case 'stdout':\n      case 'stderr':\n        onEvent({ type: eventName, data: base64ToBytes(data) });\n        return;\n      case 'exit': {\n        const parsed = safeJsonParse(data);\n        onEvent({ type: 'exit', exitCode: typeof parsed?.exit_code === 'number' ? parsed.exit_code : 0 });\n        return;\n      }\n      case 'error': {\n        const parsed = safeJsonParse(data);\n        onEvent({\n          type: 'error',\n          message: typeof parsed?.error === 'string' ? parsed.error : data,\n          code: typeof parsed?.code === 'string' ? parsed.code : undefined,\n        });\n        return;\n      }\n      default:\n        return;\n    }\n  }\n\n  private headers(): Record<string, string> {\n    return this.apiToken ? { authorization: `Bearer ${this.apiToken}` } : {};\n  }\n\n  private async request<T>(path: string, init: RequestInit, allowEmpty = false): Promise<T> {\n    const response = await this.fetchImpl(`${this.baseUrl}${path}`, {\n      ...init,\n      headers: { ...this.headers(), ...init.headers },\n    });\n    if (!response.ok) {\n      throw new CloudflareSandboxBridgeError(response.status, await response.text());\n    }\n    if (allowEmpty || response.status === 204) return undefined as T;\n    return response.json() as Promise<T>;\n  }\n}\n\nfunction base64ToBytes(value: string): Uint8Array {\n  return new Uint8Array(Buffer.from(value, 'base64'));\n}\n\nfunction safeJsonParse(value: string): Record<string, unknown> | undefined {\n  try {\n    return JSON.parse(value) as Record<string, unknown>;\n  } catch {\n    return undefined;\n  }\n}\n","import { randomUUID } from 'node:crypto';\nimport { posix } from 'node:path';\nimport type {\n  CommandResult,\n  ExecuteCommandOptions,\n  MastraSandboxOptions,\n  ProviderStatus,\n  SandboxFileInput,\n  SandboxInfo,\n} from '@mastra/core/workspace';\nimport { MastraSandbox } from '@mastra/core/workspace';\nimport { CloudflareSandboxBridgeClient, type CloudflareSandboxBridgeClientOptions } from './bridge-client';\n\nconst DEFAULT_COMMAND_TIMEOUT_MS = 300_000;\nconst WORKSPACE_ROOT = '/workspace';\n\ntype InstructionsOption = string | ((options: { defaultInstructions: string }) => string);\ntype BridgeClient = Pick<\n  CloudflareSandboxBridgeClient,\n  'createSandbox' | 'isRunning' | 'deleteSandbox' | 'writeFile' | 'exec'\n>;\n\nexport interface CloudflareSandboxOptions extends Omit<MastraSandboxOptions, 'processes'> {\n  /** URL of a deployed Cloudflare Sandbox Bridge Worker. */\n  baseUrl: string;\n  /** Bearer token matching the Worker's `SANDBOX_API_KEY` secret, when authentication is enabled. */\n  apiToken?: string;\n  /** Stable Mastra identifier for this sandbox instance. */\n  id?: string;\n  /** Existing Cloudflare sandbox ID to reconnect to instead of creating a sandbox. */\n  sandboxId?: string;\n  /** Human-readable name shown in Mastra sandbox metadata. */\n  name?: string;\n  /** Environment variables applied to every command. */\n  env?: Record<string, string>;\n  /** Working directory applied to every command. Must be under /workspace. */\n  workingDirectory?: string;\n  /** Default command timeout in milliseconds. */\n  commandTimeout?: number;\n  /** Custom instructions returned by getInstructions(). */\n  instructions?: InstructionsOption;\n  /** Custom fetch implementation, primarily for advanced networking setup and tests. */\n  fetch?: CloudflareSandboxBridgeClientOptions['fetch'];\n  /** Preconfigured Bridge client, primarily for tests. */\n  client?: BridgeClient;\n}\n\n/**\n * Builds the argv array sent to the bridge. The bridge applies ANSI-C quoting to\n * every element, so no local escaping is needed. Environment variables are applied\n * with `env`, which keeps each assignment a separate argv element.\n */\nfunction buildArgv(command: string, args: string[] | undefined, env: Record<string, string>): string[] {\n  const assignments = Object.entries(env).map(([key, value]) => {\n    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) throw new Error(`Invalid environment variable name: ${key}`);\n    return `${key}=${value}`;\n  });\n  const invocation = [command, ...(args ?? [])];\n  return assignments.length ? ['env', ...assignments, ...invocation] : invocation;\n}\n\n/** Resolves a path inside /workspace, rejecting anything that escapes the workspace root. */\nfunction resolveWorkspacePath(path: string): string {\n  const resolved = posix.resolve(WORKSPACE_ROOT, path);\n  if (resolved !== WORKSPACE_ROOT && !resolved.startsWith(`${WORKSPACE_ROOT}/`)) {\n    throw new Error(`Cloudflare Sandbox files must be written under ${WORKSPACE_ROOT}: ${path}`);\n  }\n  return resolved;\n}\n\nexport class CloudflareSandbox extends MastraSandbox {\n  readonly id: string;\n  readonly name: string;\n  readonly provider = 'cloudflare-sandbox';\n  status: ProviderStatus = 'pending';\n\n  private readonly client: BridgeClient;\n  private readonly env: Record<string, string>;\n  private readonly workingDirectory?: string;\n  private readonly commandTimeout: number;\n  private readonly instructions?: InstructionsOption;\n  private sandboxId?: string;\n  private createdAt = new Date();\n  private lastUsedAt?: Date;\n\n  constructor(options: CloudflareSandboxOptions) {\n    const name = options.name ?? 'Cloudflare Sandbox';\n    super({ ...options, name });\n    this.id = options.id ?? `cloudflare-sandbox-${randomUUID()}`;\n    this.name = name;\n    this.sandboxId = options.sandboxId;\n    this.env = { ...options.env };\n    this.workingDirectory = options.workingDirectory;\n    this.commandTimeout = options.commandTimeout ?? DEFAULT_COMMAND_TIMEOUT_MS;\n    this.instructions = options.instructions;\n    this.client =\n      options.client ??\n      new CloudflareSandboxBridgeClient({ baseUrl: options.baseUrl, apiToken: options.apiToken, fetch: options.fetch });\n  }\n\n  async start(): Promise<void> {\n    if (this.sandboxId) {\n      // The bridge boots the container on demand, so a stopped container is not fatal.\n      const running = await this.client.isRunning(this.sandboxId);\n      if (!running) {\n        this.logger?.debug(`Cloudflare sandbox ${this.sandboxId} is not running yet; it starts on first use`);\n      }\n      return;\n    }\n    this.sandboxId = await this.client.createSandbox();\n    this.createdAt = new Date();\n  }\n\n  async stop(): Promise<void> {\n    // The bridge exposes create/delete but no suspend operation. Stop detaches this\n    // Mastra lifecycle while preserving the remote sandbox for later reconnection.\n  }\n\n  async destroy(): Promise<void> {\n    if (!this.sandboxId) return;\n    await this.client.deleteSandbox(this.sandboxId);\n    this.sandboxId = undefined;\n  }\n\n  async executeCommand(command: string, args?: string[], options?: ExecuteCommandOptions): Promise<CommandResult> {\n    const sandboxId = this.requireSandboxId();\n\n    const startedAt = Date.now();\n    const timeout = options?.timeout ?? this.commandTimeout;\n    if (!Number.isFinite(timeout) || timeout <= 0) throw new RangeError('Command timeout must be positive');\n\n    const controller = new AbortController();\n    let didTimeout = false;\n    const timer = setTimeout(() => {\n      didTimeout = true;\n      controller.abort();\n    }, timeout);\n    const signal = options?.abortSignal ? AbortSignal.any([controller.signal, options.abortSignal]) : controller.signal;\n\n    // stdout and stderr are separate byte streams, so each needs its own streaming decoder.\n    const stdoutDecoder = new TextDecoder();\n    const stderrDecoder = new TextDecoder();\n    let stdout = '';\n    let stderr = '';\n    let exitCode = 1;\n\n    const env = Object.fromEntries(\n      Object.entries({ ...this.env, ...options?.env }).filter(\n        (entry): entry is [string, string] => entry[1] !== undefined,\n      ),\n    );\n\n    try {\n      await this.client.exec(\n        sandboxId,\n        {\n          argv: buildArgv(command, args, env),\n          timeoutMs: timeout,\n          cwd: options?.cwd ?? this.workingDirectory,\n        },\n        {\n          signal,\n          onEvent: event => {\n            switch (event.type) {\n              case 'stdout': {\n                const chunk = stdoutDecoder.decode(event.data, { stream: true });\n                if (!chunk) return;\n                stdout += chunk;\n                options?.onStdout?.(chunk);\n                return;\n              }\n              case 'stderr': {\n                const chunk = stderrDecoder.decode(event.data, { stream: true });\n                if (!chunk) return;\n                stderr += chunk;\n                options?.onStderr?.(chunk);\n                return;\n              }\n              case 'exit':\n                exitCode = event.exitCode;\n                return;\n              case 'error':\n                stderr += event.message;\n                options?.onStderr?.(event.message);\n                return;\n            }\n          },\n        },\n      );\n    } catch (error) {\n      if (!signal.aborted) throw error;\n    } finally {\n      clearTimeout(timer);\n    }\n\n    // Flush each decoder so a trailing truncated multi-byte sequence isn't dropped.\n    const stdoutTail = stdoutDecoder.decode();\n    if (stdoutTail) {\n      stdout += stdoutTail;\n      options?.onStdout?.(stdoutTail);\n    }\n    const stderrTail = stderrDecoder.decode();\n    if (stderrTail) {\n      stderr += stderrTail;\n      options?.onStderr?.(stderrTail);\n    }\n\n    this.lastUsedAt = new Date();\n    return {\n      command,\n      args,\n      success: exitCode === 0 && !signal.aborted,\n      exitCode,\n      stdout,\n      stderr,\n      executionTimeMs: Date.now() - startedAt,\n      timedOut: didTimeout,\n      killed: signal.aborted && !didTimeout,\n    };\n  }\n\n  async writeFiles(files: SandboxFileInput[]): Promise<void> {\n    const sandboxId = this.requireSandboxId();\n    // The bridge writes one file per request.\n    for (const file of files) {\n      await this.client.writeFile(sandboxId, resolveWorkspacePath(file.path), file.content);\n    }\n    this.lastUsedAt = new Date();\n  }\n\n  getInfo(): SandboxInfo {\n    return {\n      id: this.id,\n      name: this.name,\n      provider: this.provider,\n      status: this.status,\n      createdAt: this.createdAt,\n      lastUsedAt: this.lastUsedAt,\n      metadata: {\n        sandboxId: this.sandboxId,\n        bridgeBaseUrl: this.client instanceof CloudflareSandboxBridgeClient ? this.client.baseUrl : undefined,\n      },\n    };\n  }\n\n  getInstructions(): string {\n    const defaultInstructions =\n      'Commands execute in a remote Cloudflare Sandbox. Read and write persistent project files under /workspace.';\n    return typeof this.instructions === 'function'\n      ? this.instructions({ defaultInstructions })\n      : (this.instructions ?? defaultInstructions);\n  }\n\n  private requireSandboxId(): string {\n    if (!this.sandboxId) throw new Error(`Cloudflare Sandbox ${this.id} has not been started`);\n    return this.sandboxId;\n  }\n}\n"],"mappings":";;;;AAoBA,IAAa,+BAAb,cAAkD,MAAM;CACtD;CACA;CAEA,YAAY,QAAgB,MAAc;EACxC,MAAM,6CAA6C,OAAO,KAAK,QAAQ,kBAAkB;EACzF,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;CACd;AACF;AAEA,SAAS,qBAAqB,KAAqB;CACjD,IAAI,MAAM,IAAI;CACd,OAAO,MAAM,KAAK,IAAI,MAAM,OAAO,KAAK;CACxC,OAAO,IAAI,MAAM,GAAG,GAAG;AACzB;;AAGA,SAAS,eAAe,cAA8B;CACpD,IAAI,QAAQ;CACZ,OAAO,QAAQ,aAAa,UAAU,aAAa,WAAW,KAAK;CACnE,OAAO,aACJ,MAAM,KAAK,CAAC,CACZ,MAAM,GAAG,CAAC,CACV,KAAI,YAAW,mBAAmB,OAAO,CAAC,CAAC,CAC3C,KAAK,GAAG;AACb;;;;;;AAOA,IAAa,gCAAb,MAA2C;CACzC;CACA;CACA;CAEA,YAAY,SAA+C;EACzD,KAAK,UAAU,qBAAqB,QAAQ,OAAO;EACnD,KAAK,WAAW,QAAQ;EACxB,KAAK,YAAY,QAAQ,SAAS,WAAW;CAC/C;;CAGA,MAAM,gBAAiC;EAErC,QAAO,MADe,KAAK,QAAwB,eAAe,EAAE,QAAQ,OAAO,CAAC,EAAA,CACrE;CACjB;;CAGA,MAAM,UAAU,IAA8B;EAE5C,QAAO,MADc,KAAK,QAA8B,eAAe,mBAAmB,EAAE,EAAE,WAAW,CAAC,CAAC,EAAA,CAC7F,YAAY;CAC5B;;CAGA,MAAM,cAAc,IAA2B;EAC7C,MAAM,KAAK,QAAQ,eAAe,mBAAmB,EAAE,KAAK,EAAE,QAAQ,SAAS,GAAG,IAAI;CACxF;;CAGA,MAAM,UAAU,IAAY,cAAsB,SAA6C;EAC7F,MAAM,KAAK,QACT,eAAe,mBAAmB,EAAE,EAAE,QAAQ,eAAe,YAAY,KACzE;GACE,QAAQ;GACR,MAAM;GACN,SAAS,EAAE,gBAAgB,2BAA2B;EACxD,GACA,IACF;CACF;;CAGA,MAAM,KACJ,IACA,SACA,SAIe;EACf,MAAM,WAAW,MAAM,KAAK,UAAU,GAAG,KAAK,QAAQ,cAAc,mBAAmB,EAAE,EAAE,QAAQ;GACjG,QAAQ;GACR,SAAS;IAAE,GAAG,KAAK,QAAQ;IAAG,gBAAgB;IAAoB,QAAQ;GAAoB;GAC9F,MAAM,KAAK,UAAU;IACnB,MAAM,QAAQ;IACd,GAAI,QAAQ,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,UAAU;IAC3E,GAAI,QAAQ,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,QAAQ,IAAI;GAC1D,CAAC;GACD,QAAQ,QAAQ;EAClB,CAAC;EAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,6BAA6B,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAE/E,IAAI,CAAC,SAAS,MACZ,MAAM,IAAI,MAAM,4DAA4D;EAG9E,MAAM,SAAS,SAAS,KAAK,UAAU;EACvC,MAAM,UAAU,IAAI,YAAY;EAChC,IAAI,SAAS;EAEb,OAAO,MAAM;GACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;GAC1C,UAAU,QAAQ,OAAO,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,SAAS,IAAI;GACxE,IAAI,WAAW,OAAO,QAAQ,MAAM;GACpC,OAAO,aAAa,IAAI;IACtB,KAAK,UAAU,OAAO,MAAM,GAAG,QAAQ,GAAG,QAAQ,OAAO;IACzD,SAAS,OAAO,MAAM,WAAW,CAAC;IAClC,WAAW,OAAO,QAAQ,MAAM;GAClC;GACA,IAAI,MAAM;EACZ;EACA,IAAI,OAAO,KAAK,GAAG,KAAK,UAAU,QAAQ,QAAQ,OAAO;CAC3D;CAEA,UAAkB,OAAe,SAAwD;EACvF,IAAI;EACJ,MAAM,YAAsB,CAAC;EAC7B,KAAK,MAAM,QAAQ,MAAM,MAAM,IAAI,GACjC,IAAI,KAAK,WAAW,QAAQ,GAAG,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK;OACzD,IAAI,KAAK,WAAW,OAAO,GAAG,UAAU,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC;EAEnF,MAAM,OAAO,UAAU,KAAK,IAAI;EAChC,IAAI,CAAC,aAAa,CAAC,MAAM;EAEzB,QAAQ,WAAR;GACE,KAAK;GACL,KAAK;IACH,QAAQ;KAAE,MAAM;KAAW,MAAM,cAAc,IAAI;IAAE,CAAC;IACtD;GACF,KAAK,QAAQ;IACX,MAAM,SAAS,cAAc,IAAI;IACjC,QAAQ;KAAE,MAAM;KAAQ,UAAU,OAAO,QAAQ,cAAc,WAAW,OAAO,YAAY;IAAE,CAAC;IAChG;GACF;GACA,KAAK,SAAS;IACZ,MAAM,SAAS,cAAc,IAAI;IACjC,QAAQ;KACN,MAAM;KACN,SAAS,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ;KAC5D,MAAM,OAAO,QAAQ,SAAS,WAAW,OAAO,OAAO,KAAA;IACzD,CAAC;IACD;GACF;GACA,SACE;EACJ;CACF;CAEA,UAA0C;EACxC,OAAO,KAAK,WAAW,EAAE,eAAe,UAAU,KAAK,WAAW,IAAI,CAAC;CACzE;CAEA,MAAc,QAAW,MAAc,MAAmB,aAAa,OAAmB;EACxF,MAAM,WAAW,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,QAAQ;GAC9D,GAAG;GACH,SAAS;IAAE,GAAG,KAAK,QAAQ;IAAG,GAAG,KAAK;GAAQ;EAChD,CAAC;EACD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,6BAA6B,SAAS,QAAQ,MAAM,SAAS,KAAK,CAAC;EAE/E,IAAI,cAAc,SAAS,WAAW,KAAK,OAAO,KAAA;EAClD,OAAO,SAAS,KAAK;CACvB;AACF;AAEA,SAAS,cAAc,OAA2B;CAChD,OAAO,IAAI,WAAW,OAAO,KAAK,OAAO,QAAQ,CAAC;AACpD;AAEA,SAAS,cAAc,OAAoD;CACzE,IAAI;EACF,OAAO,KAAK,MAAM,KAAK;CACzB,QAAQ;EACN;CACF;AACF;;;AC5LA,MAAM,6BAA6B;AACnC,MAAM,iBAAiB;;;;;;AAsCvB,SAAS,UAAU,SAAiB,MAA4B,KAAuC;CACrG,MAAM,cAAc,OAAO,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;EAC5D,IAAI,CAAC,2BAA2B,KAAK,GAAG,GAAG,MAAM,IAAI,MAAM,sCAAsC,KAAK;EACtG,OAAO,GAAG,IAAI,GAAG;CACnB,CAAC;CACD,MAAM,aAAa,CAAC,SAAS,GAAI,QAAQ,CAAC,CAAE;CAC5C,OAAO,YAAY,SAAS;EAAC;EAAO,GAAG;EAAa,GAAG;CAAU,IAAI;AACvE;;AAGA,SAAS,qBAAqB,MAAsB;CAClD,MAAM,WAAW,MAAM,QAAQ,gBAAgB,IAAI;CACnD,IAAI,aAAa,kBAAkB,CAAC,SAAS,WAAW,GAAG,eAAe,EAAE,GAC1E,MAAM,IAAI,MAAM,kDAAkD,eAAe,IAAI,MAAM;CAE7F,OAAO;AACT;AAEA,IAAa,oBAAb,cAAuC,cAAc;CACnD;CACA;CACA,WAAoB;CACpB,SAAyB;CAEzB;CACA;CACA;CACA;CACA;CACA;CACA,4BAAoB,IAAI,KAAK;CAC7B;CAEA,YAAY,SAAmC;EAC7C,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM;GAAE,GAAG;GAAS;EAAK,CAAC;EAC1B,KAAK,KAAK,QAAQ,MAAM,sBAAsB,WAAW;EACzD,KAAK,OAAO;EACZ,KAAK,YAAY,QAAQ;EACzB,KAAK,MAAM,EAAE,GAAG,QAAQ,IAAI;EAC5B,KAAK,mBAAmB,QAAQ;EAChC,KAAK,iBAAiB,QAAQ,kBAAkB;EAChD,KAAK,eAAe,QAAQ;EAC5B,KAAK,SACH,QAAQ,UACR,IAAI,8BAA8B;GAAE,SAAS,QAAQ;GAAS,UAAU,QAAQ;GAAU,OAAO,QAAQ;EAAM,CAAC;CACpH;CAEA,MAAM,QAAuB;EAC3B,IAAI,KAAK,WAAW;GAGlB,IAAI,CAAC,MADiB,KAAK,OAAO,UAAU,KAAK,SAAS,GAExD,KAAK,QAAQ,MAAM,sBAAsB,KAAK,UAAU,4CAA4C;GAEtG;EACF;EACA,KAAK,YAAY,MAAM,KAAK,OAAO,cAAc;EACjD,KAAK,4BAAY,IAAI,KAAK;CAC5B;CAEA,MAAM,OAAsB,CAG5B;CAEA,MAAM,UAAyB;EAC7B,IAAI,CAAC,KAAK,WAAW;EACrB,MAAM,KAAK,OAAO,cAAc,KAAK,SAAS;EAC9C,KAAK,YAAY,KAAA;CACnB;CAEA,MAAM,eAAe,SAAiB,MAAiB,SAAyD;EAC9G,MAAM,YAAY,KAAK,iBAAiB;EAExC,MAAM,YAAY,KAAK,IAAI;EAC3B,MAAM,UAAU,SAAS,WAAW,KAAK;EACzC,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,WAAW,GAAG,MAAM,IAAI,WAAW,kCAAkC;EAEtG,MAAM,aAAa,IAAI,gBAAgB;EACvC,IAAI,aAAa;EACjB,MAAM,QAAQ,iBAAiB;GAC7B,aAAa;GACb,WAAW,MAAM;EACnB,GAAG,OAAO;EACV,MAAM,SAAS,SAAS,cAAc,YAAY,IAAI,CAAC,WAAW,QAAQ,QAAQ,WAAW,CAAC,IAAI,WAAW;EAG7G,MAAM,gBAAgB,IAAI,YAAY;EACtC,MAAM,gBAAgB,IAAI,YAAY;EACtC,IAAI,SAAS;EACb,IAAI,SAAS;EACb,IAAI,WAAW;EAEf,MAAM,MAAM,OAAO,YACjB,OAAO,QAAQ;GAAE,GAAG,KAAK;GAAK,GAAG,SAAS;EAAI,CAAC,CAAC,CAAC,QAC9C,UAAqC,MAAM,OAAO,KAAA,CACrD,CACF;EAEA,IAAI;GACF,MAAM,KAAK,OAAO,KAChB,WACA;IACE,MAAM,UAAU,SAAS,MAAM,GAAG;IAClC,WAAW;IACX,KAAK,SAAS,OAAO,KAAK;GAC5B,GACA;IACE;IACA,UAAS,UAAS;KAChB,QAAQ,MAAM,MAAd;MACE,KAAK,UAAU;OACb,MAAM,QAAQ,cAAc,OAAO,MAAM,MAAM,EAAE,QAAQ,KAAK,CAAC;OAC/D,IAAI,CAAC,OAAO;OACZ,UAAU;OACV,SAAS,WAAW,KAAK;OACzB;MACF;MACA,KAAK,UAAU;OACb,MAAM,QAAQ,cAAc,OAAO,MAAM,MAAM,EAAE,QAAQ,KAAK,CAAC;OAC/D,IAAI,CAAC,OAAO;OACZ,UAAU;OACV,SAAS,WAAW,KAAK;OACzB;MACF;MACA,KAAK;OACH,WAAW,MAAM;OACjB;MACF,KAAK;OACH,UAAU,MAAM;OAChB,SAAS,WAAW,MAAM,OAAO;OACjC;KACJ;IACF;GACF,CACF;EACF,SAAS,OAAO;GACd,IAAI,CAAC,OAAO,SAAS,MAAM;EAC7B,UAAU;GACR,aAAa,KAAK;EACpB;EAGA,MAAM,aAAa,cAAc,OAAO;EACxC,IAAI,YAAY;GACd,UAAU;GACV,SAAS,WAAW,UAAU;EAChC;EACA,MAAM,aAAa,cAAc,OAAO;EACxC,IAAI,YAAY;GACd,UAAU;GACV,SAAS,WAAW,UAAU;EAChC;EAEA,KAAK,6BAAa,IAAI,KAAK;EAC3B,OAAO;GACL;GACA;GACA,SAAS,aAAa,KAAK,CAAC,OAAO;GACnC;GACA;GACA;GACA,iBAAiB,KAAK,IAAI,IAAI;GAC9B,UAAU;GACV,QAAQ,OAAO,WAAW,CAAC;EAC7B;CACF;CAEA,MAAM,WAAW,OAA0C;EACzD,MAAM,YAAY,KAAK,iBAAiB;EAExC,KAAK,MAAM,QAAQ,OACjB,MAAM,KAAK,OAAO,UAAU,WAAW,qBAAqB,KAAK,IAAI,GAAG,KAAK,OAAO;EAEtF,KAAK,6BAAa,IAAI,KAAK;CAC7B;CAEA,UAAuB;EACrB,OAAO;GACL,IAAI,KAAK;GACT,MAAM,KAAK;GACX,UAAU,KAAK;GACf,QAAQ,KAAK;GACb,WAAW,KAAK;GAChB,YAAY,KAAK;GACjB,UAAU;IACR,WAAW,KAAK;IAChB,eAAe,KAAK,kBAAkB,gCAAgC,KAAK,OAAO,UAAU,KAAA;GAC9F;EACF;CACF;CAEA,kBAA0B;EACxB,MAAM,sBACJ;EACF,OAAO,OAAO,KAAK,iBAAiB,aAChC,KAAK,aAAa,EAAE,oBAAoB,CAAC,IACxC,KAAK,gBAAgB;CAC5B;CAEA,mBAAmC;EACjC,IAAI,CAAC,KAAK,WAAW,MAAM,IAAI,MAAM,sBAAsB,KAAK,GAAG,sBAAsB;EACzF,OAAO,KAAK;CACd;AACF"}

package/dist/sandbox.d.ts

@@ -0,0 +1,56 @@
+import type { CommandResult, ExecuteCommandOptions, MastraSandboxOptions, ProviderStatus, SandboxFileInput, SandboxInfo } from '@mastra/core/workspace';
+import { MastraSandbox } from '@mastra/core/workspace';
+import { CloudflareSandboxBridgeClient, type CloudflareSandboxBridgeClientOptions } from './bridge-client.js';
+type InstructionsOption = string | ((options: {
+    defaultInstructions: string;
+}) => string);
+type BridgeClient = Pick<CloudflareSandboxBridgeClient, 'createSandbox' | 'isRunning' | 'deleteSandbox' | 'writeFile' | 'exec'>;
+export interface CloudflareSandboxOptions extends Omit<MastraSandboxOptions, 'processes'> {
+    /** URL of a deployed Cloudflare Sandbox Bridge Worker. */
+    baseUrl: string;
+    /** Bearer token matching the Worker's `SANDBOX_API_KEY` secret, when authentication is enabled. */
+    apiToken?: string;
+    /** Stable Mastra identifier for this sandbox instance. */
+    id?: string;
+    /** Existing Cloudflare sandbox ID to reconnect to instead of creating a sandbox. */
+    sandboxId?: string;
+    /** Human-readable name shown in Mastra sandbox metadata. */
+    name?: string;
+    /** Environment variables applied to every command. */
+    env?: Record<string, string>;
+    /** Working directory applied to every command. Must be under /workspace. */
+    workingDirectory?: string;
+    /** Default command timeout in milliseconds. */
+    commandTimeout?: number;
+    /** Custom instructions returned by getInstructions(). */
+    instructions?: InstructionsOption;
+    /** Custom fetch implementation, primarily for advanced networking setup and tests. */
+    fetch?: CloudflareSandboxBridgeClientOptions['fetch'];
+    /** Preconfigured Bridge client, primarily for tests. */
+    client?: BridgeClient;
+}
+export declare class CloudflareSandbox extends MastraSandbox {
+    readonly id: string;
+    readonly name: string;
+    readonly provider = "cloudflare-sandbox";
+    status: ProviderStatus;
+    private readonly client;
+    private readonly env;
+    private readonly workingDirectory?;
+    private readonly commandTimeout;
+    private readonly instructions?;
+    private sandboxId?;
+    private createdAt;
+    private lastUsedAt?;
+    constructor(options: CloudflareSandboxOptions);
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    destroy(): Promise<void>;
+    executeCommand(command: string, args?: string[], options?: ExecuteCommandOptions): Promise<CommandResult>;
+    writeFiles(files: SandboxFileInput[]): Promise<void>;
+    getInfo(): SandboxInfo;
+    getInstructions(): string;
+    private requireSandboxId;
+}
+export {};
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,WAAW,EACZ,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,6BAA6B,EAAE,KAAK,oCAAoC,EAAE,MAAM,iBAAiB,CAAC;AAK3G,KAAK,kBAAkB,GAAG,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE;IAAE,mBAAmB,EAAE,MAAM,CAAA;CAAE,KAAK,MAAM,CAAC,CAAC;AAC1F,KAAK,YAAY,GAAG,IAAI,CACtB,6BAA6B,EAC7B,eAAe,GAAG,WAAW,GAAG,eAAe,GAAG,WAAW,GAAG,MAAM,CACvE,CAAC;AAEF,MAAM,WAAW,wBAAyB,SAAQ,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IACvF,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,sFAAsF;IACtF,KAAK,CAAC,EAAE,oCAAoC,CAAC,OAAO,CAAC,CAAC;IACtD,wDAAwD;IACxD,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAyBD,qBAAa,iBAAkB,SAAQ,aAAa;IAClD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,wBAAwB;IACzC,MAAM,EAAE,cAAc,CAAa;IAEnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAyB;IAC7C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAqB;IACnD,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAc;IAC/B,OAAO,CAAC,UAAU,CAAC,CAAO;gBAEd,OAAO,EAAE,wBAAwB;IAevC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAatB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAKrB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAMxB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC;IAiGzG,UAAU,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAS1D,OAAO,IAAI,WAAW;IAetB,eAAe,IAAI,MAAM;IAQzB,OAAO,CAAC,gBAAgB;CAIzB"}

package/dist/testing/fake-bridge.d.ts

@@ -0,0 +1,44 @@
+/**
+ * In-memory stand-in for a deployed Cloudflare Sandbox Bridge Worker.
+ *
+ * It implements the documented routes and SSE contract from
+ * https://developers.cloudflare.com/sandbox/bridge/http-api/ so unit tests drive
+ * the real `CloudflareSandboxBridgeClient` over `fetch` instead of a mock client.
+ */
+export interface FakeExecRequest {
+    argv: string[];
+    timeout_ms?: number;
+    cwd?: string;
+}
+export interface FakeExecResult {
+    stdout?: string;
+    stderr?: string;
+    exitCode?: number;
+    /** Emit an `error` event instead of `exit`. */
+    error?: {
+        error: string;
+        code?: string;
+    };
+    /** Split stdout into this many SSE frames to exercise chunked decoding. */
+    stdoutChunks?: number;
+}
+export interface FakeBridgeRequest {
+    method: string;
+    url: string;
+    authorization?: string;
+    body?: string;
+}
+export interface FakeBridge {
+    fetch: typeof globalThis.fetch;
+    requests: FakeBridgeRequest[];
+    execs: FakeExecRequest[];
+    files: Map<string, string>;
+    sandboxes: Set<string>;
+    /** Overrides the default `echo`-only behaviour. */
+    onExec?: (request: FakeExecRequest) => FakeExecResult;
+}
+export declare function createFakeBridge(options?: {
+    apiToken?: string;
+    baseUrl?: string;
+}): FakeBridge;
+//# sourceMappingURL=fake-bridge.d.ts.map

package/dist/testing/fake-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-bridge.d.ts","sourceRoot":"","sources":["../../src/testing/fake-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,KAAK,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC/B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,mDAAmD;IACnD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,cAAc,CAAC;CACvD;AAqBD,wBAAgB,gBAAgB,CAAC,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,UAAU,CA+ElG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mastra/cloudflare-sandbox",
-  "version": "0.0.0",
+  "version": "0.2.0-alpha.0",
   "description": "Cloudflare Sandbox provider for Mastra workspaces",
   "type": "module",
   "main": "dist/index.js",
@@ -18,31 +18,20 @@
     },
     "./package.json": "./package.json"
   },
-  "scripts": {
-    "build": "tsdown --silent --config tsdown.config.ts",
-    "build:lib": "pnpm build",
-    "build:watch": "pnpm build --watch",
-    "test:unit": "vitest run --exclude '**/*.integration.test.ts'",
-    "test:watch": "vitest watch",
-    "test": "vitest run ./src/**/*.integration.test.ts",
-    "test:cloud": "pnpm test",
-    "lint": "oxlint . && eslint .",
-    "lint:fix": "oxlint --fix . && eslint --fix ."
-  },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@internal/lint": "workspace:*",
-    "@internal/types-builder": "workspace:*",
-    "@internal/workspace-test-utils": "workspace:*",
-    "@mastra/core": "workspace:*",
     "@types/node": "22.19.15",
-    "@vitest/coverage-v8": "catalog:",
-    "@vitest/ui": "catalog:",
+    "@vitest/coverage-v8": "4.1.10",
+    "@vitest/ui": "4.1.10",
     "dotenv": "^17.4.2",
     "eslint": "^10.7.0",
     "tsdown": "0.22.9",
-    "typescript": "catalog:",
-    "vitest": "catalog:"
+    "typescript": "^6.0.3",
+    "vitest": "4.1.10",
+    "@internal/lint": "0.0.123",
+    "@internal/workspace-test-utils": "0.0.67",
+    "@internal/types-builder": "0.0.98",
+    "@mastra/core": "1.60.0-alpha.12"
   },
   "peerDependencies": {
     "@mastra/core": ">=1.12.0-0 <2.0.0-0"
@@ -62,5 +51,16 @@
   },
   "engines": {
     "node": ">=22.13.0"
+  },
+  "scripts": {
+    "build": "tsdown --silent --config tsdown.config.ts",
+    "build:lib": "pnpm build",
+    "build:watch": "pnpm build --watch",
+    "test:unit": "vitest run --exclude '**/*.integration.test.ts'",
+    "test:watch": "vitest watch",
+    "test": "vitest run ./src/**/*.integration.test.ts",
+    "test:cloud": "pnpm test",
+    "lint": "oxlint . && eslint .",
+    "lint:fix": "oxlint --fix . && eslint --fix ."
   }
-}
+}