@mastra/deployer-sandbox 0.1.2 → 0.1.3

package/dist/index.js

@@ -1,289 +1,304 @@
-import { DEFAULT_PORT, resolveRemoteDir, runInSandbox, shellQuote, killPreviousServer, INSTALL_MARKER, SERVER_SCRIPT, launchServer, waitForHealthy, tailServerLog, getInfoSafe, SERVER_PIDFILE, SERVER_LOGFILE } from './chunk-Z636GNUQ.js';
-import { mkdtemp, readFile, rm, writeFile, access } from 'fs/promises';
-import { join, dirname } from 'path';
-import { fileURLToPath } from 'url';
-import { Deployer } from '@mastra/deployer';
-import { copy } from 'fs-extra/esm';
-import { execFile } from 'child_process';
-import { createHash } from 'crypto';
-import { existsSync } from 'fs';
-import { tmpdir } from 'os';
-import { promisify } from 'util';
-import { supportsNetworking } from '@mastra/core/workspace';
-
-// src/alias.ts
+import { a as SERVER_SCRIPT, c as launchServer, d as shellQuote, f as tailServerLog, i as SERVER_PIDFILE, l as resolveRemoteDir, n as INSTALL_MARKER, o as getInfoSafe, p as waitForHealthy, r as SERVER_LOGFILE, s as killPreviousServer, t as DEFAULT_PORT, u as runInSandbox } from "./shared-C-piQAcU.js";
+import { access, mkdtemp, readFile, rm, writeFile } from "fs/promises";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import { Deployer } from "@mastra/deployer";
+import { copy } from "fs-extra/esm";
+import { execFile } from "child_process";
+import { createHash } from "crypto";
+import { existsSync } from "fs";
+import { tmpdir } from "os";
+import { promisify } from "util";
+import { supportsNetworking } from "@mastra/core/workspace";
+//#region src/alias.ts
+/**
+* Upsert a Vercel Edge Config item so a stable key always points at the
+* current sandbox URL. Used for Tier 3 routing: apps read the key from Edge
+* Config (e.g. in middleware) instead of hardcoding the rotating sandbox URL.
+*/
 async function updateEdgeConfigAlias(options) {
-  const { token, teamId } = options;
-  if (!token) {
-    throw new Error("Updating the Edge Config alias requires a Vercel API token. Pass `alias.token`.");
-  }
-  const endpoint = new URL(`https://api.vercel.com/v1/edge-config/${options.edgeConfigId}/items`);
-  if (teamId) {
-    endpoint.searchParams.set("teamId", teamId);
-  }
-  const res = await fetch(endpoint, {
-    method: "PATCH",
-    headers: {
-      Authorization: `Bearer ${token}`,
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify({
-      items: [{ operation: "upsert", key: options.key, value: options.url }]
-    }),
-    // Bounded so a hung Vercel API request can't keep `mastra build` open
-    // after the sandbox itself is already deployed.
-    signal: AbortSignal.timeout(3e4)
-  });
-  if (!res.ok) {
-    const body = await res.text().catch(() => "");
-    throw new Error(`Failed to update Edge Config alias "${options.key}" (${res.status}): ${body}`);
-  }
+	const { token, teamId } = options;
+	if (!token) throw new Error("Updating the Edge Config alias requires a Vercel API token. Pass `alias.token`.");
+	const endpoint = new URL(`https://api.vercel.com/v1/edge-config/${options.edgeConfigId}/items`);
+	if (teamId) endpoint.searchParams.set("teamId", teamId);
+	const res = await fetch(endpoint, {
+		method: "PATCH",
+		headers: {
+			Authorization: `Bearer ${token}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({ items: [{
+			operation: "upsert",
+			key: options.key,
+			value: options.url
+		}] }),
+		signal: AbortSignal.timeout(3e4)
+	});
+	if (!res.ok) {
+		const body = await res.text().catch(() => "");
+		throw new Error(`Failed to update Edge Config alias "${options.key}" (${res.status}): ${body}`);
+	}
 }
-var execFileAsync = promisify(execFile);
-var noopLogger = {
-  debug: () => {
-  },
-  info: () => {
-  },
-  warn: () => {
-  },
-  error: () => {
-  }
+//#endregion
+//#region src/engine.ts
+const execFileAsync = promisify(execFile);
+const noopLogger = {
+	debug: () => {},
+	info: () => {},
+	warn: () => {},
+	error: () => {}
 };
-var UPLOAD_CHUNK_SIZE = 96e3;
+/** Max shell-command payload per chunk for the base64 upload fallback. */
+const UPLOAD_CHUNK_SIZE = 96e3;
+/**
+* Deploy a prebuilt Mastra server directory into any workspace sandbox that
+* supports networking. Provider-agnostic: only uses the core WorkspaceSandbox
+* contract (`executeCommand` + `networking`, with `writeFiles` / `processes`
+* as fast paths).
+*/
 async function deployToSandbox(options) {
-  const {
-    sandbox,
-    dir,
-    port = DEFAULT_PORT,
-    env = {},
-    studio = false,
-    healthCheckPath = "/api",
-    healthCheckTimeoutMs = 6e4,
-    healthCheckIntervalMs = 1e3,
-    installCommand = "npm install --omit=dev",
-    logger = noopLogger
-  } = options;
-  if (!existsSync(join(dir, "index.mjs"))) {
-    throw new Error(`No index.mjs found in "${dir}" \u2014 did the build succeed?`);
-  }
-  logger.info(`Starting ${sandbox.provider} sandbox...`);
-  await sandbox.start?.();
-  if (!supportsNetworking(sandbox)) {
-    throw new Error(
-      `Sandbox provider "${sandbox.provider}" does not support networking (public port URLs), which is required for sandbox deploys.`
-    );
-  }
-  if (!sandbox.executeCommand) {
-    throw new Error(
-      `Sandbox provider "${sandbox.provider}" does not support executeCommand, which is required for sandbox deploys.`
-    );
-  }
-  const url = await sandbox.networking.getPortUrl(port);
-  if (!url) {
-    throw new Error(
-      `Sandbox provider "${sandbox.provider}" did not expose a public URL for port ${port}. Make sure the port is declared when constructing the sandbox (e.g. \`ports: [${port}]\`).`
-    );
-  }
-  const remoteDir = await resolveRemoteDir(sandbox, options.remoteDir);
-  const mergedEnv = { ...env };
-  if (studio && mergedEnv.MASTRA_STUDIO_PATH === void 0) {
-    mergedEnv.MASTRA_STUDIO_PATH = `${remoteDir}/studio`;
-  }
-  logger.info(`Uploading build output from ${dir}...`);
-  const tarball = await createTarball(dir);
-  logger.debug(`Tarball size: ${(tarball.length / 1024 / 1024).toFixed(2)} MB`);
-  const remoteTarball = `${remoteDir}/.deploy.tgz`;
-  await runInSandbox(sandbox, `mkdir -p ${shellQuote(remoteDir)}`);
-  await uploadFile(sandbox, remoteTarball, tarball);
-  await killPreviousServer(sandbox, remoteDir);
-  await runInSandbox(sandbox, `cd ${shellQuote(remoteDir)} && tar -xzf .deploy.tgz && rm -f .deploy.tgz`, {
-    timeout: 12e4
-  });
-  const installHash = await hashInstallInputs(dir, installCommand);
-  const marker = `${remoteDir}/${INSTALL_MARKER}`;
-  const markerCheck = await runInSandbox(sandbox, `cat ${shellQuote(marker)} 2>/dev/null || true`, {
-    allowFailure: true
-  });
-  if (installHash && markerCheck.stdout.trim() === installHash) {
-    logger.info("Dependencies unchanged \u2014 skipping install.");
-  } else {
-    logger.info(`Installing dependencies (${installCommand})...`);
-    await runInSandbox(sandbox, `cd ${shellQuote(remoteDir)} && ${installCommand}`, {
-      timeout: 6e5,
-      label: `install dependencies (${installCommand})`
-    });
-    if (installHash) {
-      await runInSandbox(sandbox, `printf '%s' ${shellQuote(installHash)} > ${shellQuote(marker)}`);
-    }
-  }
-  const launchScript = buildLaunchScript({ remoteDir, port, env: mergedEnv });
-  await uploadFile(sandbox, `${remoteDir}/${SERVER_SCRIPT}`, Buffer.from(launchScript));
-  await runInSandbox(sandbox, `chmod 700 ${shellQuote(`${remoteDir}/${SERVER_SCRIPT}`)}`);
-  logger.info("Starting Mastra server...");
-  await launchServer(sandbox, remoteDir);
-  const healthy = await waitForHealthy(url, {
-    path: healthCheckPath,
-    timeoutMs: healthCheckTimeoutMs,
-    intervalMs: healthCheckIntervalMs
-  });
-  if (!healthy) {
-    const log = await tailServerLog(sandbox, remoteDir).catch(() => "");
-    throw new Error(
-      `Mastra server did not become healthy at ${url}${healthCheckPath} within ${healthCheckTimeoutMs}ms.` + (log ? `
-
-Server log:
-${log}` : "\n\n(no server log output captured)")
-    );
-  }
-  const info = await getInfoSafe(sandbox);
-  return {
-    url,
-    sandboxId: info?.id ?? sandbox.id,
-    expiresAt: info?.timeoutAt,
-    stop: async () => {
-      await sandbox.stop?.();
-    },
-    destroy: async () => {
-      await sandbox.destroy?.();
-    },
-    logs: (lines) => tailServerLog(sandbox, remoteDir, lines)
-  };
+	const { sandbox, dir, port = DEFAULT_PORT, env = {}, studio = false, healthCheckPath = "/api", healthCheckTimeoutMs = 6e4, healthCheckIntervalMs = 1e3, installCommand = "npm install --omit=dev", logger = noopLogger } = options;
+	if (!existsSync(join(dir, "index.mjs"))) throw new Error(`No index.mjs found in "${dir}" — did the build succeed?`);
+	logger.info(`Starting ${sandbox.provider} sandbox...`);
+	await sandbox.start?.();
+	if (!supportsNetworking(sandbox)) throw new Error(`Sandbox provider "${sandbox.provider}" does not support networking (public port URLs), which is required for sandbox deploys.`);
+	if (!sandbox.executeCommand) throw new Error(`Sandbox provider "${sandbox.provider}" does not support executeCommand, which is required for sandbox deploys.`);
+	const url = await sandbox.networking.getPortUrl(port);
+	if (!url) throw new Error(`Sandbox provider "${sandbox.provider}" did not expose a public URL for port ${port}. Make sure the port is declared when constructing the sandbox (e.g. \`ports: [${port}]\`).`);
+	const remoteDir = await resolveRemoteDir(sandbox, options.remoteDir);
+	const mergedEnv = { ...env };
+	if (studio && mergedEnv.MASTRA_STUDIO_PATH === void 0) mergedEnv.MASTRA_STUDIO_PATH = `${remoteDir}/studio`;
+	logger.info(`Uploading build output from ${dir}...`);
+	const tarball = await createTarball(dir);
+	logger.debug(`Tarball size: ${(tarball.length / 1024 / 1024).toFixed(2)} MB`);
+	const remoteTarball = `${remoteDir}/.deploy.tgz`;
+	await runInSandbox(sandbox, `mkdir -p ${shellQuote(remoteDir)}`);
+	await uploadFile(sandbox, remoteTarball, tarball);
+	await killPreviousServer(sandbox, remoteDir);
+	await runInSandbox(sandbox, `cd ${shellQuote(remoteDir)} && tar -xzf .deploy.tgz && rm -f .deploy.tgz`, { timeout: 12e4 });
+	const installHash = await hashInstallInputs(dir, installCommand);
+	const marker = `${remoteDir}/${INSTALL_MARKER}`;
+	const markerCheck = await runInSandbox(sandbox, `cat ${shellQuote(marker)} 2>/dev/null || true`, { allowFailure: true });
+	if (installHash && markerCheck.stdout.trim() === installHash) logger.info("Dependencies unchanged — skipping install.");
+	else {
+		logger.info(`Installing dependencies (${installCommand})...`);
+		await runInSandbox(sandbox, `cd ${shellQuote(remoteDir)} && ${installCommand}`, {
+			timeout: 6e5,
+			label: `install dependencies (${installCommand})`
+		});
+		if (installHash) await runInSandbox(sandbox, `printf '%s' ${shellQuote(installHash)} > ${shellQuote(marker)}`);
+	}
+	const launchScript = buildLaunchScript({
+		remoteDir,
+		port,
+		env: mergedEnv
+	});
+	await uploadFile(sandbox, `${remoteDir}/${SERVER_SCRIPT}`, Buffer.from(launchScript));
+	await runInSandbox(sandbox, `chmod 700 ${shellQuote(`${remoteDir}/${SERVER_SCRIPT}`)}`);
+	logger.info("Starting Mastra server...");
+	await launchServer(sandbox, remoteDir);
+	if (!await waitForHealthy(url, {
+		path: healthCheckPath,
+		timeoutMs: healthCheckTimeoutMs,
+		intervalMs: healthCheckIntervalMs
+	})) {
+		const log = await tailServerLog(sandbox, remoteDir).catch(() => "");
+		throw new Error(`Mastra server did not become healthy at ${url}${healthCheckPath} within ${healthCheckTimeoutMs}ms.` + (log ? `\n\nServer log:\n${log}` : "\n\n(no server log output captured)"));
+	}
+	const info = await getInfoSafe(sandbox);
+	return {
+		url,
+		sandboxId: info?.id ?? sandbox.id,
+		expiresAt: info?.timeoutAt,
+		stop: async () => {
+			await sandbox.stop?.();
+		},
+		destroy: async () => {
+			await sandbox.destroy?.();
+		},
+		logs: (lines) => tailServerLog(sandbox, remoteDir, lines)
+	};
 }
+/**
+* Build the POSIX launch script. Re-running the script restarts the server —
+* the wake path uses this after a snapshot resume (which restores the
+* filesystem but not processes).
+*/
 function buildLaunchScript(opts) {
-  const lines = ["#!/bin/sh", `cd ${shellQuote(opts.remoteDir)}`];
-  const env = {
-    MASTRA_AUTO_DETECT_URL: "true",
-    ...opts.env,
-    PORT: String(opts.port),
-    MASTRA_HOST: "0.0.0.0"
-  };
-  for (const [key, value] of Object.entries(env)) {
-    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
-      throw new Error(`Invalid environment variable name: "${key}"`);
-    }
-    lines.push(`export ${key}=${shellQuote(value)}`);
-  }
-  lines.push(`echo $$ > ${shellQuote(SERVER_PIDFILE)}`);
-  lines.push(`exec node index.mjs >> ${shellQuote(SERVER_LOGFILE)} 2>&1`);
-  return lines.join("\n") + "\n";
+	const lines = ["#!/bin/sh", `cd ${shellQuote(opts.remoteDir)}`];
+	const env = {
+		MASTRA_AUTO_DETECT_URL: "true",
+		...opts.env,
+		PORT: String(opts.port),
+		MASTRA_HOST: "0.0.0.0"
+	};
+	for (const [key, value] of Object.entries(env)) {
+		if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) throw new Error(`Invalid environment variable name: "${key}"`);
+		lines.push(`export ${key}=${shellQuote(value)}`);
+	}
+	lines.push(`echo $$ > ${shellQuote(SERVER_PIDFILE)}`);
+	lines.push(`exec node index.mjs >> ${shellQuote(SERVER_LOGFILE)} 2>&1`);
+	return lines.join("\n") + "\n";
 }
+/** Create a gzipped tarball of the directory contents (excluding node_modules). */
 async function createTarball(dir) {
-  const tmp = await mkdtemp(join(tmpdir(), "mastra-sandbox-"));
-  const tarPath = join(tmp, "deploy.tgz");
-  try {
-    await execFileAsync("tar", ["-czf", tarPath, "--exclude=node_modules", "-C", dir, "."]);
-    return await readFile(tarPath);
-  } finally {
-    await rm(tmp, { recursive: true, force: true });
-  }
+	const tmp = await mkdtemp(join(tmpdir(), "mastra-sandbox-"));
+	const tarPath = join(tmp, "deploy.tgz");
+	try {
+		await execFileAsync("tar", [
+			"-czf",
+			tarPath,
+			"--exclude=node_modules",
+			"-C",
+			dir,
+			"."
+		]);
+		return await readFile(tarPath);
+	} finally {
+		await rm(tmp, {
+			recursive: true,
+			force: true
+		});
+	}
 }
+/**
+* Upload a file into the sandbox. Uses the provider's native `writeFiles` fast
+* path when available, otherwise falls back to base64 chunks over
+* `executeCommand` — so `executeCommand` + `networking` is the minimum contract.
+*/
 async function uploadFile(sandbox, remotePath, content) {
-  if (sandbox.writeFiles) {
-    await sandbox.writeFiles([{ path: remotePath, content }]);
-    return;
-  }
-  const b64 = content.toString("base64");
-  const tmpPath = `${remotePath}.b64`;
-  await runInSandbox(sandbox, `rm -f ${shellQuote(tmpPath)}`);
-  for (let i = 0; i < b64.length; i += UPLOAD_CHUNK_SIZE) {
-    const chunk = b64.slice(i, i + UPLOAD_CHUNK_SIZE);
-    await runInSandbox(sandbox, `printf '%s' ${shellQuote(chunk)} >> ${shellQuote(tmpPath)}`, {
-      label: `upload chunk to ${remotePath}`
-    });
-  }
-  await runInSandbox(
-    sandbox,
-    `base64 -d ${shellQuote(tmpPath)} > ${shellQuote(remotePath)} && rm -f ${shellQuote(tmpPath)}`,
-    { label: `decode upload at ${remotePath}` }
-  );
+	if (sandbox.writeFiles) {
+		await sandbox.writeFiles([{
+			path: remotePath,
+			content
+		}]);
+		return;
+	}
+	const b64 = content.toString("base64");
+	const tmpPath = `${remotePath}.b64`;
+	await runInSandbox(sandbox, `rm -f ${shellQuote(tmpPath)}`);
+	for (let i = 0; i < b64.length; i += UPLOAD_CHUNK_SIZE) await runInSandbox(sandbox, `printf '%s' ${shellQuote(b64.slice(i, i + UPLOAD_CHUNK_SIZE))} >> ${shellQuote(tmpPath)}`, { label: `upload chunk to ${remotePath}` });
+	await runInSandbox(sandbox, `base64 -d ${shellQuote(tmpPath)} > ${shellQuote(remotePath)} && rm -f ${shellQuote(tmpPath)}`, { label: `decode upload at ${remotePath}` });
 }
-var LOCKFILES = ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock"];
+/** Lockfiles that, when present in the build output, participate in the install-skip hash. */
+const LOCKFILES = [
+	"package-lock.json",
+	"npm-shrinkwrap.json",
+	"pnpm-lock.yaml",
+	"yarn.lock",
+	"bun.lock"
+];
+/**
+* Hash everything that determines the outcome of a dependency install:
+* package.json, any bundled lockfile, and the install command itself. A
+* matching hash means the previous `node_modules` can be reused.
+*/
 async function hashInstallInputs(dir, installCommand) {
-  const hash = createHash("sha256");
-  try {
-    hash.update(await readFile(join(dir, "package.json")));
-  } catch {
-    return null;
-  }
-  for (const lockfile of LOCKFILES) {
-    let content;
-    try {
-      content = await readFile(join(dir, lockfile));
-    } catch {
-      continue;
-    }
-    hash.update(lockfile).update(content);
-  }
-  hash.update(installCommand);
-  return hash.digest("hex");
+	const hash = createHash("sha256");
+	try {
+		hash.update(await readFile(join(dir, "package.json")));
+	} catch {
+		return null;
+	}
+	for (const lockfile of LOCKFILES) {
+		let content;
+		try {
+			content = await readFile(join(dir, lockfile));
+		} catch {
+			continue;
+		}
+		hash.update(lockfile).update(content);
+	}
+	hash.update(installCommand);
+	return hash.digest("hex");
 }
-var MANIFEST_FILENAME = "sandbox-deployment.json";
+//#endregion
+//#region src/manifest.ts
+const MANIFEST_FILENAME = "sandbox-deployment.json";
+/** Write `sandbox-deployment.json` into the build output directory. */
 async function writeDeploymentManifest(outputDir, manifest) {
-  await writeFile(join(outputDir, MANIFEST_FILENAME), JSON.stringify(manifest, null, 2));
+	await writeFile(join(outputDir, MANIFEST_FILENAME), JSON.stringify(manifest, null, 2));
 }
+/** Read `sandbox-deployment.json` from the build output directory, or null when absent. */
 async function readDeploymentManifest(outputDir) {
-  let raw;
-  try {
-    raw = await readFile(join(outputDir, MANIFEST_FILENAME), "utf-8");
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      return null;
-    }
-    throw error;
-  }
-  return JSON.parse(raw);
+	let raw;
+	try {
+		raw = await readFile(join(outputDir, MANIFEST_FILENAME), "utf-8");
+	} catch (error) {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	}
+	return JSON.parse(raw);
 }
-
-// src/deployer.ts
+//#endregion
+//#region src/deployer.ts
+/**
+* Deploy a full Mastra server into any workspace sandbox that supports
+* networking (Vercel Sandbox, E2B, ...) and get a live public URL.
+*
+* Positioning: ephemeral environments — instant previews, PR/CI smoke deploys,
+* agent-built-app verification. Not production hosting.
+*
+* @example
+* ```typescript
+* import { SandboxDeployer } from '@mastra/deployer-sandbox';
+* import { VercelSandbox } from '@mastra/vercel';
+*
+* export const mastra = new Mastra({
+*   deployer: new SandboxDeployer({
+*     sandbox: new VercelSandbox({ sandboxName: 'my-preview', timeout: 3_600_000, ports: [4111] }),
+*   }),
+* });
+* ```
+*/
 var SandboxDeployer = class extends Deployer {
-  /** Sandbox deploys are push-style: `mastra build` runs `deploy()` after bundling. */
-  deployOnBuild = true;
-  sandbox;
-  port;
-  studio;
-  /** Explicit remote dir, when configured. The engine defaults to `$HOME/mastra-app` inside the sandbox. */
-  remoteDir;
-  env;
-  alias;
-  healthCheckTimeoutMs;
-  constructor(options) {
-    super({ name: "SANDBOX" });
-    this.sandbox = options.sandbox;
-    this.port = options.port ?? DEFAULT_PORT;
-    this.studio = options.studio ?? true;
-    this.remoteDir = options.remoteDir;
-    this.env = options.env ?? {};
-    this.alias = options.alias;
-    this.healthCheckTimeoutMs = options.healthCheckTimeoutMs;
-  }
-  /**
-   * Merge all existing env files instead of only the first one (base behavior).
-   * Later files win in `loadEnvVars()`, so order least → most specific: a
-   * `.env.local` written by `vercel env pull` shouldn't shadow the `.env` that
-   * holds the app's own keys.
-   */
-  async getEnvFiles() {
-    const candidates = [".env", ".env.production", ".env.local"];
-    const existing = [];
-    for (const file of candidates) {
-      try {
-        await access(file);
-        existing.push(file);
-      } catch {
-      }
-    }
-    return existing;
-  }
-  async getUserBundlerOptions(mastraEntryFile, outputDirectory) {
-    const bundlerOptions = await super.getUserBundlerOptions(mastraEntryFile, outputDirectory);
-    return {
-      ...bundlerOptions,
-      externals: true
-    };
-  }
-  getEntry() {
-    return `
+	/** Sandbox deploys are push-style: `mastra build` runs `deploy()` after bundling. */
+	deployOnBuild = true;
+	sandbox;
+	port;
+	studio;
+	/** Explicit remote dir, when configured. The engine defaults to `$HOME/mastra-app` inside the sandbox. */
+	remoteDir;
+	env;
+	alias;
+	healthCheckTimeoutMs;
+	constructor(options) {
+		super({ name: "SANDBOX" });
+		this.sandbox = options.sandbox;
+		this.port = options.port ?? 4111;
+		this.studio = options.studio ?? true;
+		this.remoteDir = options.remoteDir;
+		this.env = options.env ?? {};
+		this.alias = options.alias;
+		this.healthCheckTimeoutMs = options.healthCheckTimeoutMs;
+	}
+	/**
+	* Merge all existing env files instead of only the first one (base behavior).
+	* Later files win in `loadEnvVars()`, so order least → most specific: a
+	* `.env.local` written by `vercel env pull` shouldn't shadow the `.env` that
+	* holds the app's own keys.
+	*/
+	async getEnvFiles() {
+		const candidates = [
+			".env",
+			".env.production",
+			".env.local"
+		];
+		const existing = [];
+		for (const file of candidates) try {
+			await access(file);
+			existing.push(file);
+		} catch {}
+		return existing;
+	}
+	async getUserBundlerOptions(mastraEntryFile, outputDirectory) {
+		return {
+			...await super.getUserBundlerOptions(mastraEntryFile, outputDirectory),
+			externals: true
+		};
+	}
+	getEntry() {
+		return `
     // @ts-expect-error
     import { scoreTracesWorkflow } from '@mastra/core/evals/scoreTraces';
     import { mastra } from '#mastra';
@@ -301,72 +316,69 @@ var SandboxDeployer = class extends Deployer {
       mastra.__registerInternalWorkflow(scoreTracesWorkflow);
     }
     `;
-  }
-  async prepare(outputDirectory) {
-    await super.prepare(outputDirectory);
-    if (this.studio) {
-      const __filename = fileURLToPath(import.meta.url);
-      const __dirname = dirname(__filename);
-      const studioSource = join(dirname(__dirname), "dist", "studio");
-      const studioServePath = join(outputDirectory, this.outputDir, "studio");
-      try {
-        await copy(studioSource, studioServePath, { overwrite: true });
-      } catch (err) {
-        throw new Error(
-          `Failed to copy studio assets from "${studioSource}" to "${studioServePath}": ${err instanceof Error ? err.message : err}`
-        );
-      }
-    }
-  }
-  async bundle(entryFile, outputDirectory, { toolsPaths, projectRoot }) {
-    return this._bundle(this.getEntry(), entryFile, { outputDirectory, projectRoot }, toolsPaths);
-  }
-  /**
-   * Deploy the built output into the sandbox and wait for the server to come
-   * up on its public URL. Writes `sandbox-deployment.json` into the output
-   * directory and updates the Edge Config alias when configured.
-   */
-  async deploy(outputDirectory) {
-    const dir = join(outputDirectory, this.outputDir);
-    const envVars = await this.loadEnvVars();
-    const env = { ...Object.fromEntries(envVars), ...this.env };
-    if (envVars.size > 0) {
-      this.logger.warn(
-        "Environment variables from your .env file are injected into the remote sandbox. Anyone with access to the sandbox can read them."
-      );
-    }
-    const deployment = await deployToSandbox({
-      sandbox: this.sandbox,
-      dir,
-      port: this.port,
-      env,
-      studio: this.studio,
-      remoteDir: this.remoteDir,
-      healthCheckTimeoutMs: this.healthCheckTimeoutMs,
-      logger: this.logger
-    });
-    await writeDeploymentManifest(dir, {
-      provider: this.sandbox.provider,
-      sandboxId: deployment.sandboxId,
-      url: deployment.url,
-      port: this.port,
-      deployedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      expiresAt: deployment.expiresAt?.toISOString()
-    });
-    if (this.alias) {
-      await updateEdgeConfigAlias({ ...this.alias, url: deployment.url });
-      this.logger.info(`Edge Config alias "${this.alias.key}" now points at ${deployment.url}`);
-    }
-    this.logger.info(`Mastra server deployed: ${deployment.url}/api`);
-    if (this.studio) {
-      this.logger.info(`Studio: ${deployment.url}`);
-    }
-    if (deployment.expiresAt) {
-      this.logger.warn(`Sandbox expires at ${deployment.expiresAt.toISOString()} (provider runtime cap).`);
-    }
-  }
+	}
+	async prepare(outputDirectory) {
+		await super.prepare(outputDirectory);
+		if (this.studio) {
+			const studioSource = join(dirname(dirname(fileURLToPath(import.meta.url))), "dist", "studio");
+			const studioServePath = join(outputDirectory, this.outputDir, "studio");
+			try {
+				await copy(studioSource, studioServePath, { overwrite: true });
+			} catch (err) {
+				throw new Error(`Failed to copy studio assets from "${studioSource}" to "${studioServePath}": ${err instanceof Error ? err.message : err}`);
+			}
+		}
+	}
+	async bundle(entryFile, outputDirectory, { toolsPaths, projectRoot }) {
+		return this._bundle(this.getEntry(), entryFile, {
+			outputDirectory,
+			projectRoot
+		}, toolsPaths);
+	}
+	/**
+	* Deploy the built output into the sandbox and wait for the server to come
+	* up on its public URL. Writes `sandbox-deployment.json` into the output
+	* directory and updates the Edge Config alias when configured.
+	*/
+	async deploy(outputDirectory) {
+		const dir = join(outputDirectory, this.outputDir);
+		const envVars = await this.loadEnvVars();
+		const env = {
+			...Object.fromEntries(envVars),
+			...this.env
+		};
+		if (envVars.size > 0) this.logger.warn("Environment variables from your .env file are injected into the remote sandbox. Anyone with access to the sandbox can read them.");
+		const deployment = await deployToSandbox({
+			sandbox: this.sandbox,
+			dir,
+			port: this.port,
+			env,
+			studio: this.studio,
+			remoteDir: this.remoteDir,
+			healthCheckTimeoutMs: this.healthCheckTimeoutMs,
+			logger: this.logger
+		});
+		await writeDeploymentManifest(dir, {
+			provider: this.sandbox.provider,
+			sandboxId: deployment.sandboxId,
+			url: deployment.url,
+			port: this.port,
+			deployedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			expiresAt: deployment.expiresAt?.toISOString()
+		});
+		if (this.alias) {
+			await updateEdgeConfigAlias({
+				...this.alias,
+				url: deployment.url
+			});
+			this.logger.info(`Edge Config alias "${this.alias.key}" now points at ${deployment.url}`);
+		}
+		this.logger.info(`Mastra server deployed: ${deployment.url}/api`);
+		if (this.studio) this.logger.info(`Studio: ${deployment.url}`);
+		if (deployment.expiresAt) this.logger.warn(`Sandbox expires at ${deployment.expiresAt.toISOString()} (provider runtime cap).`);
+	}
 };
-
+//#endregion
 export { MANIFEST_FILENAME, SandboxDeployer, buildLaunchScript, deployToSandbox, readDeploymentManifest, updateEdgeConfigAlias, writeDeploymentManifest };
-//# sourceMappingURL=index.js.map
+
 //# sourceMappingURL=index.js.map