@mastra/deployer 1.79.0-alpha.1 → 1.79.0-alpha.10

package/dist/_types/@mastra_hono/dist/browser-stream/index.d.ts

@@ -1,5 +1,45 @@
+import type { Mastra } from '@mastra/core/mastra';
 import type { BrowserStreamConfig, BrowserStreamResult } from '@mastra/server/browser-stream';
-import type { Env, Hono, Schema } from 'hono';
+import type { Context, Env, Hono, Schema } from 'hono';
+/**
+ * Allowed `Origin` values for browser WebSocket upgrades. Accepts the same shape
+ * as Hono's `cors.origin` option.
+ */
+export type BrowserStreamOrigin = string | string[] | ((origin: string, c: Context) => Promise<string | undefined | null> | string | undefined | null);
+/**
+ * Hono-specific browser stream configuration.
+ */
+export interface HonoBrowserStreamConfig extends BrowserStreamConfig {
+    /**
+     * Mastra instance used to authenticate requests to the browser stream routes.
+     *
+     * Every route registered by {@link setupBrowserStream} — the WebSocket upgrade,
+     * the session probe, the close endpoint, and the upgrade-ticket endpoint — is
+     * gated by the server auth middleware. Without this, an unauthenticated caller
+     * could watch and drive an agent's browser. When the instance has no
+     * `server.auth` configured the middleware is a no-op.
+     */
+    mastra: Mastra;
+    /**
+     * Origin allowlist for the browser WebSocket upgrade.
+     *
+     * Browsers always send an `Origin` header on a WebSocket handshake and attach
+     * the session cookie to it, so without an allowlist a page on any origin could
+     * open a cookie-authenticated stream and drive the agent's browser. When this is
+     * set, an upgrade from an origin that isn't allowed is rejected with `403`.
+     *
+     * Values are matched the way Hono's `cors.origin` matches them: array entries
+     * literally, and a callback only approves an origin when it returns that same
+     * origin (or `'*'`). The server's own origin always passes, because a CORS
+     * allowlist names the *other* origins and never includes the server itself.
+     *
+     * Requests without an `Origin` header (non-browser clients) are not affected,
+     * and the check is skipped entirely when this is unset. The deployer passes the
+     * explicitly configured `server.cors.origin` here; its permissive default is
+     * left as-is so cross-origin Studio deployments keep working.
+     */
+    allowedOrigins?: BrowserStreamOrigin;
+}
 /**
  * Set up WebSocket-based browser stream endpoint for real-time screencast viewing.
  *
@@ -9,6 +49,17 @@ import type { Env, Hono, Schema } from 'hono';
  * - Broadcasts frames to all connected viewers
  * - Stops screencast when last viewer disconnects
  *
+ * All routes are authenticated with the server's auth configuration. Browsers
+ * cannot attach an `Authorization` header to a WebSocket upgrade, so
+ * session-cookie providers authenticate from the upgrade request's cookies.
+ * Clients that authenticate with a header token instead request a short-lived,
+ * single-use ticket from `POST ${apiPrefix}/agents/:agentId/browser/stream-ticket`
+ * and pass it to the upgrade as `?ticket=`, which keeps the reusable credential
+ * out of the URL. Non-browser clients can pass the token as the `apiKey` query
+ * parameter — use a short-lived token, since a URL can be retained in proxy and
+ * access logs, and prefer the `Authorization` header on the HTTP routes where the
+ * client can set one.
+ *
  * **Note**: Requires `ws` package to be installed. If not available, returns null
  * and logs a warning. Browser streaming will be disabled but everything else works.
  *
@@ -24,6 +75,7 @@ import type { Env, Hono, Schema } from 'hono';
  *
  * const app = new Hono();
  * const browserStream = await setupBrowserStream(app, {
+ *   mastra,
  *   getToolset: (agentId) => browserToolsets.get(agentId),
  * });
  *
@@ -31,5 +83,5 @@ import type { Env, Hono, Schema } from 'hono';
  * browserStream?.injectWebSocket(server);
  * ```
  */
-export declare function setupBrowserStream<E extends Env, S extends Schema, B extends string>(app: Hono<E, S, B>, config: BrowserStreamConfig): Promise<BrowserStreamResult | null>;
+export declare function setupBrowserStream<E extends Env, S extends Schema, B extends string>(app: Hono<E, S, B>, config: HonoBrowserStreamConfig): Promise<BrowserStreamResult | null>;
 //# sourceMappingURL=index.d.ts.map

package/dist/_types/@mastra_hono/dist/index.d.ts

@@ -8,6 +8,7 @@ import type { Context, HonoRequest, MiddlewareHandler } from 'hono';
 export { createAuthMiddleware } from './auth-middleware.js';
 export type { HonoAuthMiddlewareOptions } from './auth-middleware.js';
 export { setupBrowserStream } from './browser-stream/index.js';
+export type { HonoBrowserStreamConfig } from './browser-stream/index.js';
 export type HonoVariables = {
     mastra: Mastra;
     requestContext: RequestContext;

package/dist/{analyze-BP0cLyWH.js → analyze-CFPQzJ-2.js}

@@ -1,18 +1,20 @@
 import { a as getPackageName, c as isBuiltinModule, f as rollupSafeName, i as getNodeResolveOptions, l as isDependencyPartOfPackage, m as slash, r as getCompiledDepCachePath, s as isBareModuleSpecifier, u as isExternalProtocolImport } from "./utils-Bl3Lm7SI.js";
-import { i as DepsService } from "./services-DXqmEy8F.js";
-import { a as mastraToolsAliasPlugin, c as removeDeployer, d as moduleAlias, f as getPackageInfo$1, g as esbuild, h as esmShim, i as mastraInternalAliasPlugin, l as protocolExternalResolver, m as getPackageRootPath, o as tsConfigPaths, p as getPackageMetadata, s as subpathExternalsResolver } from "./bundler-DtMHSv5_.js";
-import { existsSync } from "fs";
+import { i as DepsService, o as withPlaceholderVersions } from "./services-Ce_5qHk2.js";
+import { a as mastraToolsAliasPlugin, c as removeDeployer, d as moduleAlias, f as getPackageInfo$1, g as esbuild, h as esmShim, i as mastraInternalAliasPlugin, l as protocolExternalResolver, m as getPackageRootPath, o as tsConfigPaths, p as getPackageMetadata, s as subpathExternalsResolver } from "./bundler-B2N9qjjr.js";
+import { existsSync, readFileSync } from "fs";
 import { readFile, writeFile } from "fs/promises";
 import * as path$1 from "path";
-import { basename, dirname, isAbsolute, join, relative } from "path";
+import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "path";
 import { ErrorCategory, ErrorDomain, MastraBaseError, MastraError } from "@mastra/core/error";
 import virtual from "@rollup/plugin-virtual";
 import * as pkg from "empathic/package";
+import { glob } from "tinyglobby";
 import { transformAsync, transformSync, types } from "@babel/core";
-import { createWorkspacesCache, findWorkspaces, findWorkspacesRoot } from "find-workspaces";
 import { ensureDir } from "fs-extra";
 import { spawn } from "child_process";
 import { fileURLToPath, pathToFileURL } from "url";
+import { parse } from "yaml";
+import { homedir } from "os";
 import commonjs from "@rollup/plugin-commonjs";
 import json from "@rollup/plugin-json";
 import { getPackageInfo, resolveModule } from "local-pkg";
@@ -44,7 +46,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-//#region src/bundler/workspaceDependencies.ts
+//#region src/bundler/find-workspaces.ts
 var import_stack_trace_parser_cjs = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	var UNKNOWN_FUNCTION = "<unknown>";
@@ -139,6 +141,142 @@ var import_stack_trace_parser_cjs = /* @__PURE__ */ __toESM((/* @__PURE__ */ __c
 	exports.parse = parse;
 })))(), 1);
 /**
+* Monorepo workspace discovery.
+*
+* Replaces the `find-workspaces` package with the same API, so that the
+* production dependency tree no longer carries `fast-glob` → `micromatch` →
+* `braces` (GHSA-vfj7-8cjw-p6xm, no patched release). Globbing goes through
+* `tinyglobby`, which the deployer already uses for bundling.
+*
+* Root detection order matches `find-workspaces`: `lerna.json`, then
+* `pnpm-workspace.yaml`, then `package.json` (`workspaces` array,
+* `workspaces.packages`, or `bolt.workspaces`).
+*/
+function createWorkspacesCache() {
+	return {
+		root: /* @__PURE__ */ new Map(),
+		workspaces: /* @__PURE__ */ new Map(),
+		clear() {
+			this.root.clear();
+			this.workspaces.clear();
+		}
+	};
+}
+/**
+* Walk up from `dirname` until a directory declaring workspace globs is found.
+* Returns `null` when none is found before `stopDir`.
+*/
+function findWorkspacesRoot(dirname, options = {}) {
+	const dir = dirname ? resolve(dirname) : process.cwd();
+	const stopDir = options.stopDir ? resolve(options.stopDir) : homedir();
+	const cache = options.cache;
+	if (cache) {
+		for (const [key, value] of cache.root.entries()) if ((dir + sep).startsWith(key + sep)) return value;
+	}
+	return findRoot(dir, stopDir, cache);
+}
+/**
+* List every workspace package under the root that contains `dirname`.
+* Returns `null` when `dirname` is not inside a workspace.
+*/
+async function findWorkspaces(dirname$1, options = {}) {
+	const root = findWorkspacesRoot(dirname$1, options);
+	if (!root) return null;
+	const cached = options.cache?.workspaces.get(root.location);
+	if (cached) return cached;
+	const manifests = await glob(toManifestGlobs(root.globs), {
+		cwd: root.location,
+		absolute: true,
+		ignore: ["**/node_modules/**"]
+	});
+	const workspaces = [];
+	for (const manifest of manifests) {
+		const location = toPosix(dirname(manifest));
+		if (location === root.location) continue;
+		const pkg = readJsonFile(location, "package.json");
+		if (isObject(pkg) && typeof pkg.name === "string") workspaces.push({
+			location,
+			package: pkg
+		});
+	}
+	options.cache?.workspaces.set(root.location, workspaces);
+	return workspaces;
+}
+/**
+* Glob for each pattern's `package.json` instead of for the directory itself. A
+* directory-only glob does not match a symlink to a directory, so a linked workspace
+* package would be dropped and never packed into the build output. Matching the
+* manifest inside it does, and is also how pnpm resolves its workspaces. Negated
+* patterns are mapped the same way so they keep excluding whole packages.
+*/
+function toManifestGlobs(globs) {
+	return globs.map((pattern) => {
+		const negated = pattern.startsWith("!");
+		const base = (negated ? pattern.slice(1) : pattern).replace(/[\\/]+$/, "");
+		return `${negated ? "!" : ""}${base}/package.json`;
+	});
+}
+function findRoot(dir, stopDir, cache) {
+	const memo = (value) => {
+		cache?.root.set(dir, value);
+		return value;
+	};
+	const globs = findGlobs(dir);
+	if (globs) return memo({
+		location: toPosix(dir),
+		globs
+	});
+	const next = resolve(dir, "..");
+	if (next === stopDir || next === dir) return memo(null);
+	return findRoot(next, stopDir, cache);
+}
+function findGlobs(dir) {
+	return resolveLernaGlobs(dir) ?? resolvePnpmGlobs(dir) ?? resolvePackageJsonGlobs(dir);
+}
+function resolveLernaGlobs(dir) {
+	const lernaJson = readJsonFile(dir, "lerna.json");
+	if (lernaJson === void 0) return null;
+	return isObject(lernaJson) && isStringArray(lernaJson.packages) ? lernaJson.packages : null;
+}
+function resolvePnpmGlobs(dir) {
+	const pnpmWorkspace = readYamlFile(dir, "pnpm-workspace.yaml");
+	if (pnpmWorkspace === void 0) return null;
+	return isObject(pnpmWorkspace) && isStringArray(pnpmWorkspace.packages) ? pnpmWorkspace.packages : ["**"];
+}
+function resolvePackageJsonGlobs(dir) {
+	const packageJson = readJsonFile(dir, "package.json");
+	if (!isObject(packageJson)) return null;
+	if (isStringArray(packageJson.workspaces)) return packageJson.workspaces;
+	if (isObject(packageJson.workspaces) && isStringArray(packageJson.workspaces.packages)) return packageJson.workspaces.packages;
+	if (isObject(packageJson.bolt) && isStringArray(packageJson.bolt.workspaces)) return packageJson.bolt.workspaces;
+	return null;
+}
+function readJsonFile(dir, file) {
+	try {
+		return JSON.parse(readFileSync(join(dir, file), "utf8"));
+	} catch {
+		return;
+	}
+}
+function readYamlFile(dir, file) {
+	try {
+		return parse(readFileSync(join(dir, file), "utf8"));
+	} catch {
+		return;
+	}
+}
+function toPosix(path) {
+	return path.split(sep).join(posix.sep);
+}
+function isObject(value) {
+	return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isStringArray(value) {
+	return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+//#endregion
+//#region src/bundler/workspaceDependencies.ts
+/**
 * Create a shared cache for find-workspaces
 */
 const workspacesCache = createWorkspacesCache();
@@ -193,7 +331,7 @@ const collectTransitiveWorkspaceDependencies = async ({ workspaceMap, initialDep
 			const sanitizedName = slugify(pkgName);
 			resolutions[pkgName] = depsService.getWorkspaceDependencyPath({
 				pkgName: sanitizedName,
-				version: dep.version
+				version: dep.version ?? "0.0.0"
 			});
 			usedWorkspacePackages.add(pkgName);
 			for (const [depName, _depVersion] of Object.entries(dep?.dependencies ?? {})) if (!usedWorkspacePackages.has(depName) && workspaceMap.has(depName)) queue.push(depName);
@@ -219,21 +357,26 @@ const packWorkspaceDependencies = async ({ workspaceMap, usedWorkspacePackages,
 		logger.info("Packaging workspace dependencies", { count: usedWorkspacePackages.size });
 		const batchSize = 5;
 		const packages = Array.from(usedWorkspacePackages.values());
-		for (let i = 0; i < packages.length; i += batchSize) {
-			const batch = packages.slice(i, i + batchSize);
-			logger.info(`Packaging batch ${Math.floor(i / batchSize) + 1}/${Math.ceil(packages.length / batchSize)}: ${batch.join(", ")}`);
-			await Promise.all(batch.map(async (pkgName) => {
-				const dep = workspaceMap.get(pkgName);
-				const sanitizedName = slugify(pkgName);
-				if (!dep) return;
-				await depsService.pack({
-					dir: dep.location,
-					destination: workspaceDirPath,
-					sanitizedName,
-					version: dep.version
-				});
-			}));
-		}
+		await withPlaceholderVersions(packages.flatMap((pkgName) => {
+			const location = workspaceMap.get(pkgName)?.location;
+			return location ? [location] : [];
+		}), async () => {
+			for (let i = 0; i < packages.length; i += batchSize) {
+				const batch = packages.slice(i, i + batchSize);
+				logger.info(`Packaging batch ${Math.floor(i / batchSize) + 1}/${Math.ceil(packages.length / batchSize)}: ${batch.join(", ")}`);
+				await Promise.all(batch.map(async (pkgName) => {
+					const dep = workspaceMap.get(pkgName);
+					const sanitizedName = slugify(pkgName);
+					if (!dep) return;
+					await depsService.pack({
+						dir: dep.location,
+						destination: workspaceDirPath,
+						sanitizedName,
+						version: dep.version ?? "0.0.0"
+					});
+				}));
+			}
+		});
 		logger.info("Successfully packaged workspace dependencies", { count: usedWorkspacePackages.size });
 	}
 };
@@ -1459,4 +1602,4 @@ async function analyzeBundle(entries, mastraEntry, { outputDir, projectRoot, pla
 //#endregion
 export { aliasHono as a, packWorkspaceDependencies as c, bundleExternals as i, checkConfigExport as n, collectTransitiveWorkspaceDependencies as o, normalizeExternals as r, getWorkspaceInformation as s, analyzeBundle as t };
 
-//# sourceMappingURL=analyze-BP0cLyWH.js.map
+//# sourceMappingURL=analyze-CFPQzJ-2.js.map