@mastra/deployer-sandbox 0.1.3-alpha.0 → 0.1.3

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @mastra/deployer-sandbox
 
+## 0.1.3
+
+### Patch Changes
+
+- Updated dependencies [[`ce93a3c`](https://github.com/mastra-ai/mastra/commit/ce93a3c114ea1cbfbd576f3db41d7c26c9844f5b), [`5718a22`](https://github.com/mastra-ai/mastra/commit/5718a229281dcfd36bcd1f42a242e3717e510a33), [`a211d09`](https://github.com/mastra-ai/mastra/commit/a211d09185dc65a746534914cf38b67f21ee9bac), [`0dca9d0`](https://github.com/mastra-ai/mastra/commit/0dca9d0b1356024a53b72ea6f040db528b126caa), [`6218217`](https://github.com/mastra-ai/mastra/commit/62182171b6cfca0b099f1c6a77a2e65e7639ab86), [`5807d3a`](https://github.com/mastra-ai/mastra/commit/5807d3ae1d259b8b7d6df7e5bf2b485c694af9c8), [`57661af`](https://github.com/mastra-ai/mastra/commit/57661afeca52ff9af4e72675ede2134fa503d5a5), [`05db566`](https://github.com/mastra-ai/mastra/commit/05db566fcbdcbf33d0bffca0c72ec30129e2e3ca), [`57661af`](https://github.com/mastra-ai/mastra/commit/57661afeca52ff9af4e72675ede2134fa503d5a5), [`57661af`](https://github.com/mastra-ai/mastra/commit/57661afeca52ff9af4e72675ede2134fa503d5a5), [`5718a22`](https://github.com/mastra-ai/mastra/commit/5718a229281dcfd36bcd1f42a242e3717e510a33), [`57661af`](https://github.com/mastra-ai/mastra/commit/57661afeca52ff9af4e72675ede2134fa503d5a5), [`d1b7e3a`](https://github.com/mastra-ai/mastra/commit/d1b7e3a978a309a5653eeaa490d2d6c7c53bd093), [`29c584a`](https://github.com/mastra-ai/mastra/commit/29c584a13a88831e5ed1fdeb0ff8e82eae180433), [`c093146`](https://github.com/mastra-ai/mastra/commit/c0931466404d3c521308ea119cb165bb7e695155), [`8124754`](https://github.com/mastra-ai/mastra/commit/8124754ae89fbc69f8136d1df4a91904d0f84c4e), [`d12b2e4`](https://github.com/mastra-ai/mastra/commit/d12b2e4023fd9e3d3e93a9169f5088bcee2a849c)]:
+  - @mastra/core@1.54.0
+  - @mastra/deployer@1.54.0
+
 ## 0.1.3-alpha.0
 
 ### Patch Changes

package/dist/client/index.cjs

@@ -1,159 +1,174 @@
-'use strict';
-
-var chunkCSXC6CZL_cjs = require('../chunk-CSXC6CZL.cjs');
-var workspace = require('@mastra/core/workspace');
-
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_shared = require("../shared-H9GioaPM.cjs");
+let _mastra_core_workspace = require("@mastra/core/workspace");
+//#region src/client/index.ts
+/**
+* Runtime resolver + routing helpers for sandbox deployments.
+*
+* SERVER-ONLY. This module resolves sandbox URLs using provider credentials
+* (e.g. VERCEL_TOKEN) — importing it in the browser would ship those
+* credentials to the client. Use the proxy/handler patterns instead so the
+* browser only ever talks to your own domain.
+*/
 function assertServerOnly() {
-  if (typeof globalThis.window !== "undefined") {
-    throw new Error(
-      "@mastra/deployer-sandbox/client is server-only: resolving a sandbox requires provider credentials that must never reach the browser. Proxy requests through your own backend instead (see createSandboxHandler / createSandboxProxy)."
-    );
-  }
+	if (typeof globalThis.window !== "undefined") throw new Error("@mastra/deployer-sandbox/client is server-only: resolving a sandbox requires provider credentials that must never reach the browser. Proxy requests through your own backend instead (see createSandboxHandler / createSandboxProxy).");
 }
+/**
+* Resolve (and optionally wake) a sandbox deployment.
+*
+* With `wake: false` (default) the sandbox is not started: the URL is resolved
+* only if the sandbox is already running in this process, otherwise
+* `{ url: null, status: 'stopped' | 'unknown' }` is returned and the caller
+* decides whether to wake.
+*
+* With `wake: true` the sandbox is started (providers resume by identity,
+* e.g. name), the server is relaunched if it is not answering, and the
+* deployment is returned once healthy.
+*/
 async function getDeployment(options) {
-  assertServerOnly();
-  const {
-    sandbox,
-    port = chunkCSXC6CZL_cjs.DEFAULT_PORT,
-    wake = false,
-    healthCheckPath = "/api",
-    healthCheckTimeoutMs = 6e4
-  } = options;
-  const handle = (url2, status, expiresAt) => ({
-    url: url2,
-    status,
-    expiresAt,
-    stop: async () => {
-      await sandbox.stop?.();
-    },
-    destroy: async () => {
-      await sandbox.destroy?.();
-    },
-    // Resolved lazily — reading logs requires a running sandbox anyway.
-    logs: async (lines) => chunkCSXC6CZL_cjs.tailServerLog(sandbox, await chunkCSXC6CZL_cjs.resolveRemoteDir(sandbox, options.remoteDir), lines)
-  });
-  if (!wake) {
-    const url2 = workspace.supportsNetworking(sandbox) ? await sandbox.networking.getPortUrl(port) : null;
-    if (!url2) {
-      return handle(null, "stopped");
-    }
-    const healthy2 = await chunkCSXC6CZL_cjs.waitForHealthy(url2, { path: healthCheckPath, timeoutMs: 3e3, intervalMs: 1e3 });
-    return handle(url2, healthy2 ? "running" : "stopped");
-  }
-  await sandbox.start?.();
-  if (!workspace.supportsNetworking(sandbox)) {
-    throw new Error(`Sandbox provider "${sandbox.provider}" does not support networking (public port URLs).`);
-  }
-  const url = await sandbox.networking.getPortUrl(port);
-  if (!url) {
-    throw new Error(
-      `Sandbox provider "${sandbox.provider}" did not expose a public URL for port ${port}. Make sure the port is declared when constructing the sandbox (e.g. \`ports: [${port}]\`).`
-    );
-  }
-  let healthy = await chunkCSXC6CZL_cjs.waitForHealthy(url, { path: healthCheckPath, timeoutMs: 3e3, intervalMs: 1e3 });
-  if (!healthy) {
-    const remoteDir = await chunkCSXC6CZL_cjs.resolveRemoteDir(sandbox, options.remoteDir);
-    await chunkCSXC6CZL_cjs.killPreviousServer(sandbox, remoteDir);
-    await chunkCSXC6CZL_cjs.launchServer(sandbox, remoteDir);
-    healthy = await chunkCSXC6CZL_cjs.waitForHealthy(url, { path: healthCheckPath, timeoutMs: healthCheckTimeoutMs, intervalMs: 1e3 });
-  }
-  if (!healthy) {
-    const log = await chunkCSXC6CZL_cjs.resolveRemoteDir(sandbox, options.remoteDir).then((dir) => chunkCSXC6CZL_cjs.tailServerLog(sandbox, dir)).catch(() => "");
-    throw new Error(
-      `Woke sandbox but the Mastra server did not become healthy at ${url}${healthCheckPath}.` + (log ? `
-
-Server log:
-${log}` : "")
-    );
-  }
-  const info = await chunkCSXC6CZL_cjs.getInfoSafe(sandbox);
-  return handle(url, "running", info?.timeoutAt);
+	assertServerOnly();
+	const { sandbox, port = require_shared.DEFAULT_PORT, wake = false, healthCheckPath = "/api", healthCheckTimeoutMs = 6e4 } = options;
+	const handle = (url, status, expiresAt) => ({
+		url,
+		status,
+		expiresAt,
+		stop: async () => {
+			await sandbox.stop?.();
+		},
+		destroy: async () => {
+			await sandbox.destroy?.();
+		},
+		logs: async (lines) => require_shared.tailServerLog(sandbox, await require_shared.resolveRemoteDir(sandbox, options.remoteDir), lines)
+	});
+	if (!wake) {
+		const url = (0, _mastra_core_workspace.supportsNetworking)(sandbox) ? await sandbox.networking.getPortUrl(port) : null;
+		if (!url) return handle(null, "stopped");
+		return handle(url, await require_shared.waitForHealthy(url, {
+			path: healthCheckPath,
+			timeoutMs: 3e3,
+			intervalMs: 1e3
+		}) ? "running" : "stopped");
+	}
+	await sandbox.start?.();
+	if (!(0, _mastra_core_workspace.supportsNetworking)(sandbox)) throw new Error(`Sandbox provider "${sandbox.provider}" does not support networking (public port URLs).`);
+	const url = await sandbox.networking.getPortUrl(port);
+	if (!url) throw new Error(`Sandbox provider "${sandbox.provider}" did not expose a public URL for port ${port}. Make sure the port is declared when constructing the sandbox (e.g. \`ports: [${port}]\`).`);
+	let healthy = await require_shared.waitForHealthy(url, {
+		path: healthCheckPath,
+		timeoutMs: 3e3,
+		intervalMs: 1e3
+	});
+	if (!healthy) {
+		const remoteDir = await require_shared.resolveRemoteDir(sandbox, options.remoteDir);
+		await require_shared.killPreviousServer(sandbox, remoteDir);
+		await require_shared.launchServer(sandbox, remoteDir);
+		healthy = await require_shared.waitForHealthy(url, {
+			path: healthCheckPath,
+			timeoutMs: healthCheckTimeoutMs,
+			intervalMs: 1e3
+		});
+	}
+	if (!healthy) {
+		const log = await require_shared.resolveRemoteDir(sandbox, options.remoteDir).then((dir) => require_shared.tailServerLog(sandbox, dir)).catch(() => "");
+		throw new Error(`Woke sandbox but the Mastra server did not become healthy at ${url}${healthCheckPath}.` + (log ? `\n\nServer log:\n${log}` : ""));
+	}
+	return handle(url, "running", (await require_shared.getInfoSafe(sandbox))?.timeoutAt);
 }
+/**
+* Framework-free route-handler proxy (fetch `Request` → `Response`). Mount it
+* as a catch-all API route; the browser only ever sees your own domain, and
+* the sandbox URL (which rotates across resumes) stays server-side.
+*/
 function createSandboxHandler(options) {
-  assertServerOnly();
-  let cachedUrl = null;
-  const forward = async (request, baseUrl) => {
-    const incoming = new URL(request.url);
-    const target = new URL(incoming.pathname + incoming.search, baseUrl);
-    const headers = new Headers(request.headers);
-    headers.delete("host");
-    if (options.secret) {
-      headers.set("x-mastra-sandbox-secret", options.secret);
-    }
-    const response = await fetch(target, {
-      method: request.method,
-      headers,
-      body: request.body,
-      // duplex is required by Node's fetch for streamed request bodies
-      duplex: "half",
-      redirect: "manual"
-    });
-    const location = response.headers.get("location");
-    if (location) {
-      const resolved = new URL(location, target);
-      if (resolved.origin === new URL(baseUrl).origin) {
-        const rewritten = new URL(resolved.pathname + resolved.search + resolved.hash, incoming.origin);
-        const responseHeaders = new Headers(response.headers);
-        responseHeaders.set("location", rewritten.toString());
-        return new Response(response.body, {
-          status: response.status,
-          statusText: response.statusText,
-          headers: responseHeaders
-        });
-      }
-    }
-    return response;
-  };
-  return async (request) => {
-    cachedUrl ??= options.resolve();
-    try {
-      return await forward(request, await cachedUrl);
-    } catch (error) {
-      cachedUrl = null;
-      if (!["GET", "HEAD", "OPTIONS"].includes(request.method)) {
-        throw error;
-      }
-      cachedUrl = options.resolve();
-      try {
-        return await forward(request, await cachedUrl);
-      } catch (retryError) {
-        cachedUrl = null;
-        throw retryError;
-      }
-    }
-  };
+	assertServerOnly();
+	let cachedUrl = null;
+	const forward = async (request, baseUrl) => {
+		const incoming = new URL(request.url);
+		const target = new URL(incoming.pathname + incoming.search, baseUrl);
+		const headers = new Headers(request.headers);
+		headers.delete("host");
+		if (options.secret) headers.set("x-mastra-sandbox-secret", options.secret);
+		const response = await fetch(target, {
+			method: request.method,
+			headers,
+			body: request.body,
+			duplex: "half",
+			redirect: "manual"
+		});
+		const location = response.headers.get("location");
+		if (location) {
+			const resolved = new URL(location, target);
+			if (resolved.origin === new URL(baseUrl).origin) {
+				const rewritten = new URL(resolved.pathname + resolved.search + resolved.hash, incoming.origin);
+				const responseHeaders = new Headers(response.headers);
+				responseHeaders.set("location", rewritten.toString());
+				return new Response(response.body, {
+					status: response.status,
+					statusText: response.statusText,
+					headers: responseHeaders
+				});
+			}
+		}
+		return response;
+	};
+	return async (request) => {
+		cachedUrl ??= options.resolve();
+		try {
+			return await forward(request, await cachedUrl);
+		} catch (error) {
+			cachedUrl = null;
+			if (![
+				"GET",
+				"HEAD",
+				"OPTIONS"
+			].includes(request.method)) throw error;
+			cachedUrl = options.resolve();
+			try {
+				return await forward(request, await cachedUrl);
+			} catch (retryError) {
+				cachedUrl = null;
+				throw retryError;
+			}
+		}
+	};
 }
+/**
+* Next.js middleware helper for Tier 3 routing: reads the current sandbox URL
+* from Edge Config (kept fresh by the deployer's `alias` option) and rewrites
+* the request to it. Returns `undefined` when no URL is configured so the
+* request falls through.
+*
+* ```typescript
+* // middleware.ts
+* export const middleware = createSandboxProxy({ key: 'my-preview' });
+* export const config = { matcher: '/api/:path*' };
+* ```
+*/
 function createSandboxProxy(options) {
-  assertServerOnly();
-  return async (request) => {
-    const connection = options.edgeConfig ?? process.env.EDGE_CONFIG;
-    if (!connection) {
-      throw new Error("createSandboxProxy requires an Edge Config connection string (EDGE_CONFIG).");
-    }
-    const conn = new URL(connection);
-    const token = conn.searchParams.get("token");
-    const itemUrl = new URL(`${conn.origin}${conn.pathname}/item/${encodeURIComponent(options.key)}`);
-    const res = await fetch(itemUrl, { headers: { Authorization: `Bearer ${token}` } });
-    if (!res.ok) {
-      return void 0;
-    }
-    const sandboxUrl = await res.json();
-    if (typeof sandboxUrl !== "string" || !sandboxUrl) {
-      return void 0;
-    }
-    const incoming = new URL(request.url);
-    const target = new URL(incoming.pathname + incoming.search, sandboxUrl);
-    const headers = new Headers({ "x-middleware-rewrite": target.toString() });
-    if (options.secret) {
-      headers.set("x-middleware-request-x-mastra-sandbox-secret", options.secret);
-      headers.set("x-middleware-override-headers", "x-mastra-sandbox-secret");
-    }
-    return new Response(null, { headers });
-  };
+	assertServerOnly();
+	return async (request) => {
+		const connection = options.edgeConfig ?? process.env.EDGE_CONFIG;
+		if (!connection) throw new Error("createSandboxProxy requires an Edge Config connection string (EDGE_CONFIG).");
+		const conn = new URL(connection);
+		const token = conn.searchParams.get("token");
+		const itemUrl = new URL(`${conn.origin}${conn.pathname}/item/${encodeURIComponent(options.key)}`);
+		const res = await fetch(itemUrl, { headers: { Authorization: `Bearer ${token}` } });
+		if (!res.ok) return;
+		const sandboxUrl = await res.json();
+		if (typeof sandboxUrl !== "string" || !sandboxUrl) return;
+		const incoming = new URL(request.url);
+		const target = new URL(incoming.pathname + incoming.search, sandboxUrl);
+		const headers = new Headers({ "x-middleware-rewrite": target.toString() });
+		if (options.secret) {
+			headers.set("x-middleware-request-x-mastra-sandbox-secret", options.secret);
+			headers.set("x-middleware-override-headers", "x-mastra-sandbox-secret");
+		}
+		return new Response(null, { headers });
+	};
 }
-
+//#endregion
 exports.createSandboxHandler = createSandboxHandler;
 exports.createSandboxProxy = createSandboxProxy;
 exports.getDeployment = getDeployment;
-//# sourceMappingURL=index.cjs.map
+
 //# sourceMappingURL=index.cjs.map

package/dist/client/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/client/index.ts"],"names":["DEFAULT_PORT","url","tailServerLog","resolveRemoteDir","supportsNetworking","healthy","waitForHealthy","killPreviousServer","launchServer","getInfoSafe"],"mappings":";;;;;AAoBA,SAAS,gBAAA,GAAyB;AAChC,EAAA,IAAI,OAAQ,UAAA,CAAoC,MAAA,KAAW,WAAA,EAAa;AACtE,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAGF;AAAA,EACF;AACF;AAmDA,eAAsB,cAAc,OAAA,EAA4D;AAC9F,EAAA,gBAAA,EAAiB;AAEjB,EAAA,MAAM;AAAA,IACJ,OAAA;AAAA,IACA,IAAA,GAAOA,8BAAA;AAAA,IACP,IAAA,GAAO,KAAA;AAAA,IACP,eAAA,GAAkB,MAAA;AAAA,IAClB,oBAAA,GAAuB;AAAA,GACzB,GAAI,OAAA;AAEJ,EAAA,MAAM,MAAA,GAAS,CAACC,IAAAA,EAAoB,MAAA,EAA0B,SAAA,MAA0C;AAAA,IACtG,GAAA,EAAAA,IAAAA;AAAA,IACA,MAAA;AAAA,IACA,SAAA;AAAA,IACA,MAAM,YAAY;AAChB,MAAA,MAAM,QAAQ,IAAA,IAAO;AAAA,IACvB,CAAA;AAAA,IACA,SAAS,YAAY;AACnB,MAAA,MAAM,QAAQ,OAAA,IAAU;AAAA,IAC1B,CAAA;AAAA;AAAA,IAEA,IAAA,EAAM,OAAO,KAAA,KAAmBC,+BAAA,CAAc,OAAA,EAAS,MAAMC,kCAAA,CAAiB,OAAA,EAAS,OAAA,CAAQ,SAAS,CAAA,EAAG,KAAK;AAAA,GAClH,CAAA;AAEA,EAAA,IAAI,CAAC,IAAA,EAAM;AAET,IAAA,MAAMF,IAAAA,GAAMG,6BAAmB,OAAO,CAAA,GAAI,MAAM,OAAA,CAAQ,UAAA,CAAW,UAAA,CAAW,IAAI,CAAA,GAAI,IAAA;AACtF,IAAA,IAAI,CAACH,IAAAA,EAAK;AACR,MAAA,OAAO,MAAA,CAAO,MAAM,SAAS,CAAA;AAAA,IAC/B;AACA,IAAA,MAAMI,QAAAA,GAAU,MAAMC,gCAAA,CAAeL,IAAAA,EAAK,EAAE,IAAA,EAAM,eAAA,EAAiB,SAAA,EAAW,GAAA,EAAO,UAAA,EAAY,GAAA,EAAO,CAAA;AACxG,IAAA,OAAO,MAAA,CAAOA,IAAAA,EAAKI,QAAAA,GAAU,SAAA,GAAY,SAAS,CAAA;AAAA,EACpD;AAEA,EAAA,MAAM,QAAQ,KAAA,IAAQ;AAEtB,EAAA,IAAI,CAACD,4BAAA,CAAmB,OAAO,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,OAAA,CAAQ,QAAQ,CAAA,iDAAA,CAAmD,CAAA;AAAA,EAC1G;AACA,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,UAAA,CAAW,WAAW,IAAI,CAAA;AACpD,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,qBAAqB,OAAA,CAAQ,QAAQ,CAAA,uCAAA,EAA0C,IAAI,kFACD,IAAI,CAAA,KAAA;AAAA,KACxF;AAAA,EACF;AAKA,EAAA,IAAI,OAAA,GAAU,MAAME,gCAAA,CAAe,GAAA,EAAK,EAAE,IAAA,EAAM,eAAA,EAAiB,SAAA,EAAW,GAAA,EAAO,UAAA,EAAY,GAAA,EAAO,CAAA;AACtG,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,SAAA,GAAY,MAAMH,kCAAA,CAAiB,OAAA,EAAS,QAAQ,SAAS,CAAA;AACnE,IAAA,MAAMI,oCAAA,CAAmB,SAAS,SAAS,CAAA;AAC3C,IAAA,MAAMC,8BAAA,CAAa,SAAS,SAAS,CAAA;AACrC,IAAA,OAAA,GAAU,MAAMF,gCAAA,CAAe,GAAA,EAAK,EAAE,IAAA,EAAM,iBAAiB,SAAA,EAAW,oBAAA,EAAsB,UAAA,EAAY,GAAA,EAAO,CAAA;AAAA,EACnH;AACA,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,MAAM,MAAMH,kCAAA,CAAiB,OAAA,EAAS,OAAA,CAAQ,SAAS,CAAA,CAC1D,IAAA,CAAK,CAAA,GAAA,KAAOD,+BAAA,CAAc,SAAS,GAAG,CAAC,CAAA,CACvC,KAAA,CAAM,MAAM,EAAE,CAAA;AACjB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,6DAAA,EAAgE,GAAG,CAAA,EAAG,eAAe,OAClF,GAAA,GAAM;;AAAA;AAAA,EAAoB,GAAG,CAAA,CAAA,GAAK,EAAA;AAAA,KACvC;AAAA,EACF;AAEA,EAAA,MAAM,IAAA,GAAO,MAAMO,6BAAA,CAAY,OAAO,CAAA;AACtC,EAAA,OAAO,MAAA,CAAO,GAAA,EAAK,SAAA,EAAW,IAAA,EAAM,SAAS,CAAA;AAC/C;AA+BO,SAAS,qBAAqB,OAAA,EAA+E;AAClH,EAAA,gBAAA,EAAiB;AAEjB,EAAA,IAAI,SAAA,GAAoC,IAAA;AAExC,EAAA,MAAM,OAAA,GAAU,OAAO,OAAA,EAAkB,OAAA,KAAuC;AAC9E,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AACpC,IAAA,MAAM,SAAS,IAAI,GAAA,CAAI,SAAS,QAAA,GAAW,QAAA,CAAS,QAAQ,OAAO,CAAA;AAEnE,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AAC3C,IAAA,OAAA,CAAQ,OAAO,MAAM,CAAA;AACrB,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,OAAA,CAAQ,GAAA,CAAI,yBAAA,EAA2B,OAAA,CAAQ,MAAM,CAAA;AAAA,IACvD;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,MAAA,EAAQ;AAAA,MACnC,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,OAAA;AAAA,MACA,MAAM,OAAA,CAAQ,IAAA;AAAA;AAAA,MAEd,MAAA,EAAQ,MAAA;AAAA,MACR,QAAA,EAAU;AAAA,KACI,CAAA;AAKhB,IAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,QAAA,EAAU,MAAM,CAAA;AACzC,MAAA,IAAI,SAAS,MAAA,KAAW,IAAI,GAAA,CAAI,OAAO,EAAE,MAAA,EAAQ;AAC/C,QAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,QAAA,CAAS,QAAA,GAAW,SAAS,MAAA,GAAS,QAAA,CAAS,IAAA,EAAM,QAAA,CAAS,MAAM,CAAA;AAC9F,QAAA,MAAM,eAAA,GAAkB,IAAI,OAAA,CAAQ,QAAA,CAAS,OAAO,CAAA;AACpD,QAAA,eAAA,CAAgB,GAAA,CAAI,UAAA,EAAY,SAAA,CAAU,QAAA,EAAU,CAAA;AACpD,QAAA,OAAO,IAAI,QAAA,CAAS,QAAA,CAAS,IAAA,EAAM;AAAA,UACjC,QAAQ,QAAA,CAAS,MAAA;AAAA,UACjB,YAAY,QAAA,CAAS,UAAA;AAAA,UACrB,OAAA,EAAS;AAAA,SACV,CAAA;AAAA,MACH;AAAA,IACF;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO,OAAO,OAAA,KAAwC;AACpD,IAAA,SAAA,KAAc,QAAQ,OAAA,EAAQ;AAE9B,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,OAAA,CAAQ,OAAA,EAAS,MAAM,SAAS,CAAA;AAAA,IAC/C,SAAS,KAAA,EAAO;AAMd,MAAA,SAAA,GAAY,IAAA;AACZ,MAAA,IAAI,CAAC,CAAC,KAAA,EAAO,MAAA,EAAQ,SAAS,CAAA,CAAE,QAAA,CAAS,OAAA,CAAQ,MAAM,CAAA,EAAG;AACxD,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,SAAA,GAAY,QAAQ,OAAA,EAAQ;AAC5B,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,OAAA,CAAQ,OAAA,EAAS,MAAM,SAAS,CAAA;AAAA,MAC/C,SAAS,UAAA,EAAY;AACnB,QAAA,SAAA,GAAY,IAAA;AACZ,QAAA,MAAM,UAAA;AAAA,MACR;AAAA,IACF;AAAA,EACF,CAAA;AACF;AA0BO,SAAS,mBACd,OAAA,EACqD;AAGrD,EAAA,gBAAA,EAAiB;AAEjB,EAAA,OAAO,OAAO,OAAA,KAAoD;AAChE,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,GAAA,CAAI,WAAA;AACrD,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,MAAM,IAAI,MAAM,6EAA6E,CAAA;AAAA,IAC/F;AAEA,IAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,UAAU,CAAA;AAC/B,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,OAAO,CAAA;AAC3C,IAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,CAAA,EAAG,KAAK,MAAM,CAAA,EAAG,IAAA,CAAK,QAAQ,CAAA,MAAA,EAAS,kBAAA,CAAmB,OAAA,CAAQ,GAAG,CAAC,CAAA,CAAE,CAAA;AAEhG,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,OAAA,EAAS,EAAE,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA,EAAG,EAAG,CAAA;AAClF,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,MAAM,UAAA,GAAsB,MAAM,GAAA,CAAI,IAAA,EAAK;AAC3C,IAAA,IAAI,OAAO,UAAA,KAAe,QAAA,IAAY,CAAC,UAAA,EAAY;AACjD,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AACpC,IAAA,MAAM,SAAS,IAAI,GAAA,CAAI,SAAS,QAAA,GAAW,QAAA,CAAS,QAAQ,UAAU,CAAA;AAKtE,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,EAAE,wBAAwB,MAAA,CAAO,QAAA,IAAY,CAAA;AACzE,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,OAAA,CAAQ,GAAA,CAAI,8CAAA,EAAgD,OAAA,CAAQ,MAAM,CAAA;AAC1E,MAAA,OAAA,CAAQ,GAAA,CAAI,iCAAiC,yBAAyB,CAAA;AAAA,IACxE;AACA,IAAA,OAAO,IAAI,QAAA,CAAS,IAAA,EAAM,EAAE,SAAS,CAAA;AAAA,EACvC,CAAA;AACF","file":"index.cjs","sourcesContent":["/**\n * Runtime resolver + routing helpers for sandbox deployments.\n *\n * SERVER-ONLY. This module resolves sandbox URLs using provider credentials\n * (e.g. VERCEL_TOKEN) — importing it in the browser would ship those\n * credentials to the client. Use the proxy/handler patterns instead so the\n * browser only ever talks to your own domain.\n */\nimport { supportsNetworking } from '@mastra/core/workspace';\nimport type { WorkspaceSandbox } from '@mastra/core/workspace';\nimport {\n  DEFAULT_PORT,\n  getInfoSafe,\n  killPreviousServer,\n  launchServer,\n  resolveRemoteDir,\n  tailServerLog,\n  waitForHealthy,\n} from '../shared';\n\nfunction assertServerOnly(): void {\n  if (typeof (globalThis as { window?: unknown }).window !== 'undefined') {\n    throw new Error(\n      '@mastra/deployer-sandbox/client is server-only: resolving a sandbox requires provider credentials ' +\n        'that must never reach the browser. Proxy requests through your own backend instead ' +\n        '(see createSandboxHandler / createSandboxProxy).',\n    );\n  }\n}\n\nexport type DeploymentStatus = 'running' | 'stopped' | 'unknown';\n\nexport interface GetDeploymentOptions {\n  /**\n   * The sandbox to resolve. Provider construction is identity — e.g.\n   * `new VercelSandbox({ sandboxName: 'my-preview', ports: [4111] })` resolves\n   * the same sandbox from any process.\n   */\n  sandbox: WorkspaceSandbox;\n  /** Port the Mastra server listens on. Defaults to 4111. */\n  port?: number;\n  /**\n   * Wake the sandbox when it is not running. Waking starts (resumes) the\n   * sandbox and, only if the server is not answering, relaunches it from the\n   * recorded launch script — some providers (e.g. E2B) resume processes on\n   * wake, others (e.g. Vercel) restore just the filesystem. Defaults to false.\n   */\n  wake?: boolean;\n  /** Directory the app was deployed into. Defaults to `$HOME/mastra-app` resolved inside the sandbox. */\n  remoteDir?: string;\n  /** Path polled for health. Defaults to `/api`. */\n  healthCheckPath?: string;\n  /** Max time to wait for health after a wake, in ms. Defaults to 60000. */\n  healthCheckTimeoutMs?: number;\n}\n\nexport interface ResolvedDeployment {\n  /** Public URL of the Mastra server, or null when it could not be resolved without waking. */\n  url: string | null;\n  status: DeploymentStatus;\n  /** When the sandbox will auto-shutdown (when known). */\n  expiresAt?: Date;\n  stop(): Promise<void>;\n  destroy(): Promise<void>;\n  logs(lines?: number): Promise<string>;\n}\n\n/**\n * Resolve (and optionally wake) a sandbox deployment.\n *\n * With `wake: false` (default) the sandbox is not started: the URL is resolved\n * only if the sandbox is already running in this process, otherwise\n * `{ url: null, status: 'stopped' | 'unknown' }` is returned and the caller\n * decides whether to wake.\n *\n * With `wake: true` the sandbox is started (providers resume by identity,\n * e.g. name), the server is relaunched if it is not answering, and the\n * deployment is returned once healthy.\n */\nexport async function getDeployment(options: GetDeploymentOptions): Promise<ResolvedDeployment> {\n  assertServerOnly();\n\n  const {\n    sandbox,\n    port = DEFAULT_PORT,\n    wake = false,\n    healthCheckPath = '/api',\n    healthCheckTimeoutMs = 60_000,\n  } = options;\n\n  const handle = (url: string | null, status: DeploymentStatus, expiresAt?: Date): ResolvedDeployment => ({\n    url,\n    status,\n    expiresAt,\n    stop: async () => {\n      await sandbox.stop?.();\n    },\n    destroy: async () => {\n      await sandbox.destroy?.();\n    },\n    // Resolved lazily — reading logs requires a running sandbox anyway.\n    logs: async (lines?: number) => tailServerLog(sandbox, await resolveRemoteDir(sandbox, options.remoteDir), lines),\n  });\n\n  if (!wake) {\n    // Resolve without starting the sandbox (starting can resume billing).\n    const url = supportsNetworking(sandbox) ? await sandbox.networking.getPortUrl(port) : null;\n    if (!url) {\n      return handle(null, 'stopped');\n    }\n    const healthy = await waitForHealthy(url, { path: healthCheckPath, timeoutMs: 3_000, intervalMs: 1_000 });\n    return handle(url, healthy ? 'running' : 'stopped');\n  }\n\n  await sandbox.start?.();\n\n  if (!supportsNetworking(sandbox)) {\n    throw new Error(`Sandbox provider \"${sandbox.provider}\" does not support networking (public port URLs).`);\n  }\n  const url = await sandbox.networking.getPortUrl(port);\n  if (!url) {\n    throw new Error(\n      `Sandbox provider \"${sandbox.provider}\" did not expose a public URL for port ${port}. ` +\n        `Make sure the port is declared when constructing the sandbox (e.g. \\`ports: [${port}]\\`).`,\n    );\n  }\n\n  // Some providers (e.g. Vercel) restore the filesystem but not processes on\n  // resume, while others (e.g. E2B) resume processes too — relaunch the server\n  // from the recorded launch script only when it is not answering.\n  let healthy = await waitForHealthy(url, { path: healthCheckPath, timeoutMs: 3_000, intervalMs: 1_000 });\n  if (!healthy) {\n    const remoteDir = await resolveRemoteDir(sandbox, options.remoteDir);\n    await killPreviousServer(sandbox, remoteDir);\n    await launchServer(sandbox, remoteDir);\n    healthy = await waitForHealthy(url, { path: healthCheckPath, timeoutMs: healthCheckTimeoutMs, intervalMs: 1_000 });\n  }\n  if (!healthy) {\n    const log = await resolveRemoteDir(sandbox, options.remoteDir)\n      .then(dir => tailServerLog(sandbox, dir))\n      .catch(() => '');\n    throw new Error(\n      `Woke sandbox but the Mastra server did not become healthy at ${url}${healthCheckPath}.` +\n        (log ? `\\n\\nServer log:\\n${log}` : ''),\n    );\n  }\n\n  const info = await getInfoSafe(sandbox);\n  return handle(url, 'running', info?.timeoutAt);\n}\n\n// =============================================================================\n// Tier 3 helpers\n// =============================================================================\n\nexport interface CreateSandboxHandlerOptions {\n  /**\n   * Resolve the current sandbox URL. Called once, cached, and re-invoked when\n   * a forwarded request fails at the network level (e.g. the sandbox rotated\n   * its URL or went to sleep). Typically wraps `getDeployment`:\n   *\n   * ```typescript\n   * createSandboxHandler({\n   *   resolve: async () => {\n   *     const dep = await getDeployment({ sandbox, wake: true });\n   *     return dep.url!;\n   *   },\n   * });\n   * ```\n   */\n  resolve: () => Promise<string>;\n  /** Shared secret attached as the `x-mastra-sandbox-secret` header on forwarded requests. */\n  secret?: string;\n}\n\n/**\n * Framework-free route-handler proxy (fetch `Request` → `Response`). Mount it\n * as a catch-all API route; the browser only ever sees your own domain, and\n * the sandbox URL (which rotates across resumes) stays server-side.\n */\nexport function createSandboxHandler(options: CreateSandboxHandlerOptions): (request: Request) => Promise<Response> {\n  assertServerOnly();\n\n  let cachedUrl: Promise<string> | null = null;\n\n  const forward = async (request: Request, baseUrl: string): Promise<Response> => {\n    const incoming = new URL(request.url);\n    const target = new URL(incoming.pathname + incoming.search, baseUrl);\n\n    const headers = new Headers(request.headers);\n    headers.delete('host');\n    if (options.secret) {\n      headers.set('x-mastra-sandbox-secret', options.secret);\n    }\n\n    const response = await fetch(target, {\n      method: request.method,\n      headers,\n      body: request.body,\n      // duplex is required by Node's fetch for streamed request bodies\n      duplex: 'half',\n      redirect: 'manual',\n    } as RequestInit);\n\n    // Redirects are passed through manually — rewrite sandbox-host Locations\n    // onto the incoming origin so the rotating sandbox URL never reaches the\n    // browser (and subsequent requests keep flowing through this handler).\n    const location = response.headers.get('location');\n    if (location) {\n      const resolved = new URL(location, target);\n      if (resolved.origin === new URL(baseUrl).origin) {\n        const rewritten = new URL(resolved.pathname + resolved.search + resolved.hash, incoming.origin);\n        const responseHeaders = new Headers(response.headers);\n        responseHeaders.set('location', rewritten.toString());\n        return new Response(response.body, {\n          status: response.status,\n          statusText: response.statusText,\n          headers: responseHeaders,\n        });\n      }\n    }\n\n    return response;\n  };\n\n  return async (request: Request): Promise<Response> => {\n    cachedUrl ??= options.resolve();\n\n    try {\n      return await forward(request, await cachedUrl);\n    } catch (error) {\n      // Connection-level failure: the sandbox may have rotated its URL or gone\n      // to sleep. Drop the cached URL so the next request re-resolves, and\n      // retry once — but only for idempotent, bodyless methods. A failed\n      // connection doesn't prove a write never landed, and a streamed body is\n      // already consumed.\n      cachedUrl = null;\n      if (!['GET', 'HEAD', 'OPTIONS'].includes(request.method)) {\n        throw error;\n      }\n      cachedUrl = options.resolve();\n      try {\n        return await forward(request, await cachedUrl);\n      } catch (retryError) {\n        cachedUrl = null;\n        throw retryError;\n      }\n    }\n  };\n}\n\nexport interface CreateSandboxProxyOptions {\n  /** Edge Config item key that holds the current sandbox URL. */\n  key: string;\n  /**\n   * Edge Config connection string (`https://edge-config.vercel.com/ecfg_...?token=...`).\n   * Defaults to `process.env.EDGE_CONFIG`.\n   */\n  edgeConfig?: string;\n  /** Shared secret attached as the `x-mastra-sandbox-secret` header on the rewrite. */\n  secret?: string;\n}\n\n/**\n * Next.js middleware helper for Tier 3 routing: reads the current sandbox URL\n * from Edge Config (kept fresh by the deployer's `alias` option) and rewrites\n * the request to it. Returns `undefined` when no URL is configured so the\n * request falls through.\n *\n * ```typescript\n * // middleware.ts\n * export const middleware = createSandboxProxy({ key: 'my-preview' });\n * export const config = { matcher: '/api/:path*' };\n * ```\n */\nexport function createSandboxProxy(\n  options: CreateSandboxProxyOptions,\n): (request: Request) => Promise<Response | undefined> {\n  // Reads (and would transmit) the Edge Config bearer token — same\n  // server-only contract as the rest of this module.\n  assertServerOnly();\n\n  return async (request: Request): Promise<Response | undefined> => {\n    const connection = options.edgeConfig ?? process.env.EDGE_CONFIG;\n    if (!connection) {\n      throw new Error('createSandboxProxy requires an Edge Config connection string (EDGE_CONFIG).');\n    }\n\n    const conn = new URL(connection);\n    const token = conn.searchParams.get('token');\n    const itemUrl = new URL(`${conn.origin}${conn.pathname}/item/${encodeURIComponent(options.key)}`);\n\n    const res = await fetch(itemUrl, { headers: { Authorization: `Bearer ${token}` } });\n    if (!res.ok) {\n      return undefined;\n    }\n    const sandboxUrl: unknown = await res.json();\n    if (typeof sandboxUrl !== 'string' || !sandboxUrl) {\n      return undefined;\n    }\n\n    const incoming = new URL(request.url);\n    const target = new URL(incoming.pathname + incoming.search, sandboxUrl);\n\n    // A Response with the x-middleware-rewrite header is how Next.js\n    // middleware expresses a rewrite (NextResponse.rewrite does the same) —\n    // this keeps the helper free of a next dependency.\n    const headers = new Headers({ 'x-middleware-rewrite': target.toString() });\n    if (options.secret) {\n      headers.set('x-middleware-request-x-mastra-sandbox-secret', options.secret);\n      headers.set('x-middleware-override-headers', 'x-mastra-sandbox-secret');\n    }\n    return new Response(null, { headers });\n  };\n}\n"]}
+{"version":3,"file":"index.cjs","names":["DEFAULT_PORT","tailServerLog","resolveRemoteDir","waitForHealthy","killPreviousServer","launchServer","getInfoSafe"],"sources":["../../src/client/index.ts"],"sourcesContent":["/**\n * Runtime resolver + routing helpers for sandbox deployments.\n *\n * SERVER-ONLY. This module resolves sandbox URLs using provider credentials\n * (e.g. VERCEL_TOKEN) — importing it in the browser would ship those\n * credentials to the client. Use the proxy/handler patterns instead so the\n * browser only ever talks to your own domain.\n */\nimport { supportsNetworking } from '@mastra/core/workspace';\nimport type { WorkspaceSandbox } from '@mastra/core/workspace';\nimport {\n  DEFAULT_PORT,\n  getInfoSafe,\n  killPreviousServer,\n  launchServer,\n  resolveRemoteDir,\n  tailServerLog,\n  waitForHealthy,\n} from '../shared';\n\nfunction assertServerOnly(): void {\n  if (typeof (globalThis as { window?: unknown }).window !== 'undefined') {\n    throw new Error(\n      '@mastra/deployer-sandbox/client is server-only: resolving a sandbox requires provider credentials ' +\n        'that must never reach the browser. Proxy requests through your own backend instead ' +\n        '(see createSandboxHandler / createSandboxProxy).',\n    );\n  }\n}\n\nexport type DeploymentStatus = 'running' | 'stopped' | 'unknown';\n\nexport interface GetDeploymentOptions {\n  /**\n   * The sandbox to resolve. Provider construction is identity — e.g.\n   * `new VercelSandbox({ sandboxName: 'my-preview', ports: [4111] })` resolves\n   * the same sandbox from any process.\n   */\n  sandbox: WorkspaceSandbox;\n  /** Port the Mastra server listens on. Defaults to 4111. */\n  port?: number;\n  /**\n   * Wake the sandbox when it is not running. Waking starts (resumes) the\n   * sandbox and, only if the server is not answering, relaunches it from the\n   * recorded launch script — some providers (e.g. E2B) resume processes on\n   * wake, others (e.g. Vercel) restore just the filesystem. Defaults to false.\n   */\n  wake?: boolean;\n  /** Directory the app was deployed into. Defaults to `$HOME/mastra-app` resolved inside the sandbox. */\n  remoteDir?: string;\n  /** Path polled for health. Defaults to `/api`. */\n  healthCheckPath?: string;\n  /** Max time to wait for health after a wake, in ms. Defaults to 60000. */\n  healthCheckTimeoutMs?: number;\n}\n\nexport interface ResolvedDeployment {\n  /** Public URL of the Mastra server, or null when it could not be resolved without waking. */\n  url: string | null;\n  status: DeploymentStatus;\n  /** When the sandbox will auto-shutdown (when known). */\n  expiresAt?: Date;\n  stop(): Promise<void>;\n  destroy(): Promise<void>;\n  logs(lines?: number): Promise<string>;\n}\n\n/**\n * Resolve (and optionally wake) a sandbox deployment.\n *\n * With `wake: false` (default) the sandbox is not started: the URL is resolved\n * only if the sandbox is already running in this process, otherwise\n * `{ url: null, status: 'stopped' | 'unknown' }` is returned and the caller\n * decides whether to wake.\n *\n * With `wake: true` the sandbox is started (providers resume by identity,\n * e.g. name), the server is relaunched if it is not answering, and the\n * deployment is returned once healthy.\n */\nexport async function getDeployment(options: GetDeploymentOptions): Promise<ResolvedDeployment> {\n  assertServerOnly();\n\n  const {\n    sandbox,\n    port = DEFAULT_PORT,\n    wake = false,\n    healthCheckPath = '/api',\n    healthCheckTimeoutMs = 60_000,\n  } = options;\n\n  const handle = (url: string | null, status: DeploymentStatus, expiresAt?: Date): ResolvedDeployment => ({\n    url,\n    status,\n    expiresAt,\n    stop: async () => {\n      await sandbox.stop?.();\n    },\n    destroy: async () => {\n      await sandbox.destroy?.();\n    },\n    // Resolved lazily — reading logs requires a running sandbox anyway.\n    logs: async (lines?: number) => tailServerLog(sandbox, await resolveRemoteDir(sandbox, options.remoteDir), lines),\n  });\n\n  if (!wake) {\n    // Resolve without starting the sandbox (starting can resume billing).\n    const url = supportsNetworking(sandbox) ? await sandbox.networking.getPortUrl(port) : null;\n    if (!url) {\n      return handle(null, 'stopped');\n    }\n    const healthy = await waitForHealthy(url, { path: healthCheckPath, timeoutMs: 3_000, intervalMs: 1_000 });\n    return handle(url, healthy ? 'running' : 'stopped');\n  }\n\n  await sandbox.start?.();\n\n  if (!supportsNetworking(sandbox)) {\n    throw new Error(`Sandbox provider \"${sandbox.provider}\" does not support networking (public port URLs).`);\n  }\n  const url = await sandbox.networking.getPortUrl(port);\n  if (!url) {\n    throw new Error(\n      `Sandbox provider \"${sandbox.provider}\" did not expose a public URL for port ${port}. ` +\n        `Make sure the port is declared when constructing the sandbox (e.g. \\`ports: [${port}]\\`).`,\n    );\n  }\n\n  // Some providers (e.g. Vercel) restore the filesystem but not processes on\n  // resume, while others (e.g. E2B) resume processes too — relaunch the server\n  // from the recorded launch script only when it is not answering.\n  let healthy = await waitForHealthy(url, { path: healthCheckPath, timeoutMs: 3_000, intervalMs: 1_000 });\n  if (!healthy) {\n    const remoteDir = await resolveRemoteDir(sandbox, options.remoteDir);\n    await killPreviousServer(sandbox, remoteDir);\n    await launchServer(sandbox, remoteDir);\n    healthy = await waitForHealthy(url, { path: healthCheckPath, timeoutMs: healthCheckTimeoutMs, intervalMs: 1_000 });\n  }\n  if (!healthy) {\n    const log = await resolveRemoteDir(sandbox, options.remoteDir)\n      .then(dir => tailServerLog(sandbox, dir))\n      .catch(() => '');\n    throw new Error(\n      `Woke sandbox but the Mastra server did not become healthy at ${url}${healthCheckPath}.` +\n        (log ? `\\n\\nServer log:\\n${log}` : ''),\n    );\n  }\n\n  const info = await getInfoSafe(sandbox);\n  return handle(url, 'running', info?.timeoutAt);\n}\n\n// =============================================================================\n// Tier 3 helpers\n// =============================================================================\n\nexport interface CreateSandboxHandlerOptions {\n  /**\n   * Resolve the current sandbox URL. Called once, cached, and re-invoked when\n   * a forwarded request fails at the network level (e.g. the sandbox rotated\n   * its URL or went to sleep). Typically wraps `getDeployment`:\n   *\n   * ```typescript\n   * createSandboxHandler({\n   *   resolve: async () => {\n   *     const dep = await getDeployment({ sandbox, wake: true });\n   *     return dep.url!;\n   *   },\n   * });\n   * ```\n   */\n  resolve: () => Promise<string>;\n  /** Shared secret attached as the `x-mastra-sandbox-secret` header on forwarded requests. */\n  secret?: string;\n}\n\n/**\n * Framework-free route-handler proxy (fetch `Request` → `Response`). Mount it\n * as a catch-all API route; the browser only ever sees your own domain, and\n * the sandbox URL (which rotates across resumes) stays server-side.\n */\nexport function createSandboxHandler(options: CreateSandboxHandlerOptions): (request: Request) => Promise<Response> {\n  assertServerOnly();\n\n  let cachedUrl: Promise<string> | null = null;\n\n  const forward = async (request: Request, baseUrl: string): Promise<Response> => {\n    const incoming = new URL(request.url);\n    const target = new URL(incoming.pathname + incoming.search, baseUrl);\n\n    const headers = new Headers(request.headers);\n    headers.delete('host');\n    if (options.secret) {\n      headers.set('x-mastra-sandbox-secret', options.secret);\n    }\n\n    const response = await fetch(target, {\n      method: request.method,\n      headers,\n      body: request.body,\n      // duplex is required by Node's fetch for streamed request bodies\n      duplex: 'half',\n      redirect: 'manual',\n    } as RequestInit);\n\n    // Redirects are passed through manually — rewrite sandbox-host Locations\n    // onto the incoming origin so the rotating sandbox URL never reaches the\n    // browser (and subsequent requests keep flowing through this handler).\n    const location = response.headers.get('location');\n    if (location) {\n      const resolved = new URL(location, target);\n      if (resolved.origin === new URL(baseUrl).origin) {\n        const rewritten = new URL(resolved.pathname + resolved.search + resolved.hash, incoming.origin);\n        const responseHeaders = new Headers(response.headers);\n        responseHeaders.set('location', rewritten.toString());\n        return new Response(response.body, {\n          status: response.status,\n          statusText: response.statusText,\n          headers: responseHeaders,\n        });\n      }\n    }\n\n    return response;\n  };\n\n  return async (request: Request): Promise<Response> => {\n    cachedUrl ??= options.resolve();\n\n    try {\n      return await forward(request, await cachedUrl);\n    } catch (error) {\n      // Connection-level failure: the sandbox may have rotated its URL or gone\n      // to sleep. Drop the cached URL so the next request re-resolves, and\n      // retry once — but only for idempotent, bodyless methods. A failed\n      // connection doesn't prove a write never landed, and a streamed body is\n      // already consumed.\n      cachedUrl = null;\n      if (!['GET', 'HEAD', 'OPTIONS'].includes(request.method)) {\n        throw error;\n      }\n      cachedUrl = options.resolve();\n      try {\n        return await forward(request, await cachedUrl);\n      } catch (retryError) {\n        cachedUrl = null;\n        throw retryError;\n      }\n    }\n  };\n}\n\nexport interface CreateSandboxProxyOptions {\n  /** Edge Config item key that holds the current sandbox URL. */\n  key: string;\n  /**\n   * Edge Config connection string (`https://edge-config.vercel.com/ecfg_...?token=...`).\n   * Defaults to `process.env.EDGE_CONFIG`.\n   */\n  edgeConfig?: string;\n  /** Shared secret attached as the `x-mastra-sandbox-secret` header on the rewrite. */\n  secret?: string;\n}\n\n/**\n * Next.js middleware helper for Tier 3 routing: reads the current sandbox URL\n * from Edge Config (kept fresh by the deployer's `alias` option) and rewrites\n * the request to it. Returns `undefined` when no URL is configured so the\n * request falls through.\n *\n * ```typescript\n * // middleware.ts\n * export const middleware = createSandboxProxy({ key: 'my-preview' });\n * export const config = { matcher: '/api/:path*' };\n * ```\n */\nexport function createSandboxProxy(\n  options: CreateSandboxProxyOptions,\n): (request: Request) => Promise<Response | undefined> {\n  // Reads (and would transmit) the Edge Config bearer token — same\n  // server-only contract as the rest of this module.\n  assertServerOnly();\n\n  return async (request: Request): Promise<Response | undefined> => {\n    const connection = options.edgeConfig ?? process.env.EDGE_CONFIG;\n    if (!connection) {\n      throw new Error('createSandboxProxy requires an Edge Config connection string (EDGE_CONFIG).');\n    }\n\n    const conn = new URL(connection);\n    const token = conn.searchParams.get('token');\n    const itemUrl = new URL(`${conn.origin}${conn.pathname}/item/${encodeURIComponent(options.key)}`);\n\n    const res = await fetch(itemUrl, { headers: { Authorization: `Bearer ${token}` } });\n    if (!res.ok) {\n      return undefined;\n    }\n    const sandboxUrl: unknown = await res.json();\n    if (typeof sandboxUrl !== 'string' || !sandboxUrl) {\n      return undefined;\n    }\n\n    const incoming = new URL(request.url);\n    const target = new URL(incoming.pathname + incoming.search, sandboxUrl);\n\n    // A Response with the x-middleware-rewrite header is how Next.js\n    // middleware expresses a rewrite (NextResponse.rewrite does the same) —\n    // this keeps the helper free of a next dependency.\n    const headers = new Headers({ 'x-middleware-rewrite': target.toString() });\n    if (options.secret) {\n      headers.set('x-middleware-request-x-mastra-sandbox-secret', options.secret);\n      headers.set('x-middleware-override-headers', 'x-mastra-sandbox-secret');\n    }\n    return new Response(null, { headers });\n  };\n}\n"],"mappings":";;;;;;;;;;;;AAoBA,SAAS,mBAAyB;CAChC,IAAI,OAAQ,WAAoC,WAAW,aACzD,MAAM,IAAI,MACR,uOAGF;AAEJ;;;;;;;;;;;;;AAmDA,eAAsB,cAAc,SAA4D;CAC9F,iBAAiB;CAEjB,MAAM,EACJ,SACA,OAAOA,eAAAA,cACP,OAAO,OACP,kBAAkB,QAClB,uBAAuB,QACrB;CAEJ,MAAM,UAAU,KAAoB,QAA0B,eAA0C;EACtG;EACA;EACA;EACA,MAAM,YAAY;GAChB,MAAM,QAAQ,OAAO;EACvB;EACA,SAAS,YAAY;GACnB,MAAM,QAAQ,UAAU;EAC1B;EAEA,MAAM,OAAO,UAAmBC,eAAAA,cAAc,SAAS,MAAMC,eAAAA,iBAAiB,SAAS,QAAQ,SAAS,GAAG,KAAK;CAClH;CAEA,IAAI,CAAC,MAAM;EAET,MAAM,OAAA,GAAA,uBAAA,mBAAA,CAAyB,OAAO,IAAI,MAAM,QAAQ,WAAW,WAAW,IAAI,IAAI;EACtF,IAAI,CAAC,KACH,OAAO,OAAO,MAAM,SAAS;EAG/B,OAAO,OAAO,KAAK,MADGC,eAAAA,eAAe,KAAK;GAAE,MAAM;GAAiB,WAAW;GAAO,YAAY;EAAM,CAAC,IAC3E,YAAY,SAAS;CACpD;CAEA,MAAM,QAAQ,QAAQ;CAEtB,IAAI,EAAA,GAAA,uBAAA,mBAAA,CAAoB,OAAO,GAC7B,MAAM,IAAI,MAAM,qBAAqB,QAAQ,SAAS,kDAAkD;CAE1G,MAAM,MAAM,MAAM,QAAQ,WAAW,WAAW,IAAI;CACpD,IAAI,CAAC,KACH,MAAM,IAAI,MACR,qBAAqB,QAAQ,SAAS,yCAAyC,KAAK,iFACF,KAAK,MACzF;CAMF,IAAI,UAAU,MAAMA,eAAAA,eAAe,KAAK;EAAE,MAAM;EAAiB,WAAW;EAAO,YAAY;CAAM,CAAC;CACtG,IAAI,CAAC,SAAS;EACZ,MAAM,YAAY,MAAMD,eAAAA,iBAAiB,SAAS,QAAQ,SAAS;EACnE,MAAME,eAAAA,mBAAmB,SAAS,SAAS;EAC3C,MAAMC,eAAAA,aAAa,SAAS,SAAS;EACrC,UAAU,MAAMF,eAAAA,eAAe,KAAK;GAAE,MAAM;GAAiB,WAAW;GAAsB,YAAY;EAAM,CAAC;CACnH;CACA,IAAI,CAAC,SAAS;EACZ,MAAM,MAAM,MAAMD,eAAAA,iBAAiB,SAAS,QAAQ,SAAS,CAAC,CAC3D,MAAK,QAAOD,eAAAA,cAAc,SAAS,GAAG,CAAC,CAAC,CACxC,YAAY,EAAE;EACjB,MAAM,IAAI,MACR,gEAAgE,MAAM,gBAAgB,MACnF,MAAM,oBAAoB,QAAQ,GACvC;CACF;CAGA,OAAO,OAAO,KAAK,YAAW,MADXK,eAAAA,YAAY,OAAO,EAAA,EACF,SAAS;AAC/C;;;;;;AA+BA,SAAgB,qBAAqB,SAA+E;CAClH,iBAAiB;CAEjB,IAAI,YAAoC;CAExC,MAAM,UAAU,OAAO,SAAkB,YAAuC;EAC9E,MAAM,WAAW,IAAI,IAAI,QAAQ,GAAG;EACpC,MAAM,SAAS,IAAI,IAAI,SAAS,WAAW,SAAS,QAAQ,OAAO;EAEnE,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;EAC3C,QAAQ,OAAO,MAAM;EACrB,IAAI,QAAQ,QACV,QAAQ,IAAI,2BAA2B,QAAQ,MAAM;EAGvD,MAAM,WAAW,MAAM,MAAM,QAAQ;GACnC,QAAQ,QAAQ;GAChB;GACA,MAAM,QAAQ;GAEd,QAAQ;GACR,UAAU;EACZ,CAAgB;EAKhB,MAAM,WAAW,SAAS,QAAQ,IAAI,UAAU;EAChD,IAAI,UAAU;GACZ,MAAM,WAAW,IAAI,IAAI,UAAU,MAAM;GACzC,IAAI,SAAS,WAAW,IAAI,IAAI,OAAO,CAAC,CAAC,QAAQ;IAC/C,MAAM,YAAY,IAAI,IAAI,SAAS,WAAW,SAAS,SAAS,SAAS,MAAM,SAAS,MAAM;IAC9F,MAAM,kBAAkB,IAAI,QAAQ,SAAS,OAAO;IACpD,gBAAgB,IAAI,YAAY,UAAU,SAAS,CAAC;IACpD,OAAO,IAAI,SAAS,SAAS,MAAM;KACjC,QAAQ,SAAS;KACjB,YAAY,SAAS;KACrB,SAAS;IACX,CAAC;GACH;EACF;EAEA,OAAO;CACT;CAEA,OAAO,OAAO,YAAwC;EACpD,cAAc,QAAQ,QAAQ;EAE9B,IAAI;GACF,OAAO,MAAM,QAAQ,SAAS,MAAM,SAAS;EAC/C,SAAS,OAAO;GAMd,YAAY;GACZ,IAAI,CAAC;IAAC;IAAO;IAAQ;GAAS,CAAC,CAAC,SAAS,QAAQ,MAAM,GACrD,MAAM;GAER,YAAY,QAAQ,QAAQ;GAC5B,IAAI;IACF,OAAO,MAAM,QAAQ,SAAS,MAAM,SAAS;GAC/C,SAAS,YAAY;IACnB,YAAY;IACZ,MAAM;GACR;EACF;CACF;AACF;;;;;;;;;;;;;AA0BA,SAAgB,mBACd,SACqD;CAGrD,iBAAiB;CAEjB,OAAO,OAAO,YAAoD;EAChE,MAAM,aAAa,QAAQ,cAAc,QAAQ,IAAI;EACrD,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,6EAA6E;EAG/F,MAAM,OAAO,IAAI,IAAI,UAAU;EAC/B,MAAM,QAAQ,KAAK,aAAa,IAAI,OAAO;EAC3C,MAAM,UAAU,IAAI,IAAI,GAAG,KAAK,SAAS,KAAK,SAAS,QAAQ,mBAAmB,QAAQ,GAAG,GAAG;EAEhG,MAAM,MAAM,MAAM,MAAM,SAAS,EAAE,SAAS,EAAE,eAAe,UAAU,QAAQ,EAAE,CAAC;EAClF,IAAI,CAAC,IAAI,IACP;EAEF,MAAM,aAAsB,MAAM,IAAI,KAAK;EAC3C,IAAI,OAAO,eAAe,YAAY,CAAC,YACrC;EAGF,MAAM,WAAW,IAAI,IAAI,QAAQ,GAAG;EACpC,MAAM,SAAS,IAAI,IAAI,SAAS,WAAW,SAAS,QAAQ,UAAU;EAKtE,MAAM,UAAU,IAAI,QAAQ,EAAE,wBAAwB,OAAO,SAAS,EAAE,CAAC;EACzE,IAAI,QAAQ,QAAQ;GAClB,QAAQ,IAAI,gDAAgD,QAAQ,MAAM;GAC1E,QAAQ,IAAI,iCAAiC,yBAAyB;EACxE;EACA,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,CAAC;CACvC;AACF"}