@mastra/deployer 1.79.0-alpha.1 → 1.79.0-alpha.3

package/dist/_types/@mastra_hono/dist/browser-stream/index.d.ts

@@ -1,5 +1,45 @@
+import type { Mastra } from '@mastra/core/mastra';
 import type { BrowserStreamConfig, BrowserStreamResult } from '@mastra/server/browser-stream';
-import type { Env, Hono, Schema } from 'hono';
+import type { Context, Env, Hono, Schema } from 'hono';
+/**
+ * Allowed `Origin` values for browser WebSocket upgrades. Accepts the same shape
+ * as Hono's `cors.origin` option.
+ */
+export type BrowserStreamOrigin = string | string[] | ((origin: string, c: Context) => Promise<string | undefined | null> | string | undefined | null);
+/**
+ * Hono-specific browser stream configuration.
+ */
+export interface HonoBrowserStreamConfig extends BrowserStreamConfig {
+    /**
+     * Mastra instance used to authenticate requests to the browser stream routes.
+     *
+     * Every route registered by {@link setupBrowserStream} — the WebSocket upgrade,
+     * the session probe, the close endpoint, and the upgrade-ticket endpoint — is
+     * gated by the server auth middleware. Without this, an unauthenticated caller
+     * could watch and drive an agent's browser. When the instance has no
+     * `server.auth` configured the middleware is a no-op.
+     */
+    mastra: Mastra;
+    /**
+     * Origin allowlist for the browser WebSocket upgrade.
+     *
+     * Browsers always send an `Origin` header on a WebSocket handshake and attach
+     * the session cookie to it, so without an allowlist a page on any origin could
+     * open a cookie-authenticated stream and drive the agent's browser. When this is
+     * set, an upgrade from an origin that isn't allowed is rejected with `403`.
+     *
+     * Values are matched the way Hono's `cors.origin` matches them: array entries
+     * literally, and a callback only approves an origin when it returns that same
+     * origin (or `'*'`). The server's own origin always passes, because a CORS
+     * allowlist names the *other* origins and never includes the server itself.
+     *
+     * Requests without an `Origin` header (non-browser clients) are not affected,
+     * and the check is skipped entirely when this is unset. The deployer passes the
+     * explicitly configured `server.cors.origin` here; its permissive default is
+     * left as-is so cross-origin Studio deployments keep working.
+     */
+    allowedOrigins?: BrowserStreamOrigin;
+}
 /**
  * Set up WebSocket-based browser stream endpoint for real-time screencast viewing.
  *
@@ -9,6 +49,17 @@ import type { Env, Hono, Schema } from 'hono';
  * - Broadcasts frames to all connected viewers
  * - Stops screencast when last viewer disconnects
  *
+ * All routes are authenticated with the server's auth configuration. Browsers
+ * cannot attach an `Authorization` header to a WebSocket upgrade, so
+ * session-cookie providers authenticate from the upgrade request's cookies.
+ * Clients that authenticate with a header token instead request a short-lived,
+ * single-use ticket from `POST ${apiPrefix}/agents/:agentId/browser/stream-ticket`
+ * and pass it to the upgrade as `?ticket=`, which keeps the reusable credential
+ * out of the URL. Non-browser clients can pass the token as the `apiKey` query
+ * parameter — use a short-lived token, since a URL can be retained in proxy and
+ * access logs, and prefer the `Authorization` header on the HTTP routes where the
+ * client can set one.
+ *
  * **Note**: Requires `ws` package to be installed. If not available, returns null
  * and logs a warning. Browser streaming will be disabled but everything else works.
  *
@@ -24,6 +75,7 @@ import type { Env, Hono, Schema } from 'hono';
  *
  * const app = new Hono();
  * const browserStream = await setupBrowserStream(app, {
+ *   mastra,
  *   getToolset: (agentId) => browserToolsets.get(agentId),
  * });
  *
@@ -31,5 +83,5 @@ import type { Env, Hono, Schema } from 'hono';
  * browserStream?.injectWebSocket(server);
  * ```
  */
-export declare function setupBrowserStream<E extends Env, S extends Schema, B extends string>(app: Hono<E, S, B>, config: BrowserStreamConfig): Promise<BrowserStreamResult | null>;
+export declare function setupBrowserStream<E extends Env, S extends Schema, B extends string>(app: Hono<E, S, B>, config: HonoBrowserStreamConfig): Promise<BrowserStreamResult | null>;
 //# sourceMappingURL=index.d.ts.map

package/dist/_types/@mastra_hono/dist/index.d.ts

@@ -8,6 +8,7 @@ import type { Context, HonoRequest, MiddlewareHandler } from 'hono';
 export { createAuthMiddleware } from './auth-middleware.js';
 export type { HonoAuthMiddlewareOptions } from './auth-middleware.js';
 export { setupBrowserStream } from './browser-stream/index.js';
+export type { HonoBrowserStreamConfig } from './browser-stream/index.js';
 export type HonoVariables = {
     mastra: Mastra;
     requestContext: RequestContext;

package/dist/{analyze-CcyVW_jJ.cjs → analyze-CPVTLGuy.cjs}

@@ -1,6 +1,6 @@
 const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");
 const require_utils = require("./utils-Bsr_sEcH.cjs");
-const require_services = require("./services-D_V7afWX.cjs");
+const require_services = require("./services-BQNEW5XJ.cjs");
 const require_bundler = require("./bundler-CxslAqI_.cjs");
 let fs = require("fs");
 let fs_promises = require("fs/promises");
@@ -11,11 +11,13 @@ let _rollup_plugin_virtual = require("@rollup/plugin-virtual");
 _rollup_plugin_virtual = require_rolldown_runtime.__toESM(_rollup_plugin_virtual, 1);
 let empathic_package = require("empathic/package");
 empathic_package = require_rolldown_runtime.__toESM(empathic_package, 1);
+let tinyglobby = require("tinyglobby");
 let _babel_core = require("@babel/core");
-let find_workspaces = require("find-workspaces");
 let fs_extra = require("fs-extra");
 let child_process = require("child_process");
 let url = require("url");
+let yaml = require("yaml");
+let os = require("os");
 let _rollup_plugin_commonjs = require("@rollup/plugin-commonjs");
 _rollup_plugin_commonjs = require_rolldown_runtime.__toESM(_rollup_plugin_commonjs, 1);
 let _rollup_plugin_json = require("@rollup/plugin-json");
@@ -123,12 +125,148 @@ var require_stack_trace_parser_cjs = /* @__PURE__ */ require_rolldown_runtime.__
 	exports.parse = parse;
 }));
 //#endregion
-//#region src/bundler/workspaceDependencies.ts
+//#region src/bundler/find-workspaces.ts
 var import_stack_trace_parser_cjs = /* @__PURE__ */ require_rolldown_runtime.__toESM(require_stack_trace_parser_cjs(), 1);
 /**
+* Monorepo workspace discovery.
+*
+* Replaces the `find-workspaces` package with the same API, so that the
+* production dependency tree no longer carries `fast-glob` → `micromatch` →
+* `braces` (GHSA-vfj7-8cjw-p6xm, no patched release). Globbing goes through
+* `tinyglobby`, which the deployer already uses for bundling.
+*
+* Root detection order matches `find-workspaces`: `lerna.json`, then
+* `pnpm-workspace.yaml`, then `package.json` (`workspaces` array,
+* `workspaces.packages`, or `bolt.workspaces`).
+*/
+function createWorkspacesCache() {
+	return {
+		root: /* @__PURE__ */ new Map(),
+		workspaces: /* @__PURE__ */ new Map(),
+		clear() {
+			this.root.clear();
+			this.workspaces.clear();
+		}
+	};
+}
+/**
+* Walk up from `dirname` until a directory declaring workspace globs is found.
+* Returns `null` when none is found before `stopDir`.
+*/
+function findWorkspacesRoot(dirname, options = {}) {
+	const dir = dirname ? (0, path.resolve)(dirname) : process.cwd();
+	const stopDir = options.stopDir ? (0, path.resolve)(options.stopDir) : (0, os.homedir)();
+	const cache = options.cache;
+	if (cache) {
+		for (const [key, value] of cache.root.entries()) if ((dir + path.sep).startsWith(key + path.sep)) return value;
+	}
+	return findRoot(dir, stopDir, cache);
+}
+/**
+* List every workspace package under the root that contains `dirname`.
+* Returns `null` when `dirname` is not inside a workspace.
+*/
+async function findWorkspaces(dirname, options = {}) {
+	const root = findWorkspacesRoot(dirname, options);
+	if (!root) return null;
+	const cached = options.cache?.workspaces.get(root.location);
+	if (cached) return cached;
+	const manifests = await (0, tinyglobby.glob)(toManifestGlobs(root.globs), {
+		cwd: root.location,
+		absolute: true,
+		ignore: ["**/node_modules/**"]
+	});
+	const workspaces = [];
+	for (const manifest of manifests) {
+		const location = toPosix((0, path.dirname)(manifest));
+		if (location === root.location) continue;
+		const pkg = readJsonFile(location, "package.json");
+		if (isObject(pkg) && typeof pkg.name === "string") workspaces.push({
+			location,
+			package: pkg
+		});
+	}
+	options.cache?.workspaces.set(root.location, workspaces);
+	return workspaces;
+}
+/**
+* Glob for each pattern's `package.json` instead of for the directory itself. A
+* directory-only glob does not match a symlink to a directory, so a linked workspace
+* package would be dropped and never packed into the build output. Matching the
+* manifest inside it does, and is also how pnpm resolves its workspaces. Negated
+* patterns are mapped the same way so they keep excluding whole packages.
+*/
+function toManifestGlobs(globs) {
+	return globs.map((pattern) => {
+		const negated = pattern.startsWith("!");
+		const base = (negated ? pattern.slice(1) : pattern).replace(/[\\/]+$/, "");
+		return `${negated ? "!" : ""}${base}/package.json`;
+	});
+}
+function findRoot(dir, stopDir, cache) {
+	const memo = (value) => {
+		cache?.root.set(dir, value);
+		return value;
+	};
+	const globs = findGlobs(dir);
+	if (globs) return memo({
+		location: toPosix(dir),
+		globs
+	});
+	const next = (0, path.resolve)(dir, "..");
+	if (next === stopDir || next === dir) return memo(null);
+	return findRoot(next, stopDir, cache);
+}
+function findGlobs(dir) {
+	return resolveLernaGlobs(dir) ?? resolvePnpmGlobs(dir) ?? resolvePackageJsonGlobs(dir);
+}
+function resolveLernaGlobs(dir) {
+	const lernaJson = readJsonFile(dir, "lerna.json");
+	if (lernaJson === void 0) return null;
+	return isObject(lernaJson) && isStringArray(lernaJson.packages) ? lernaJson.packages : null;
+}
+function resolvePnpmGlobs(dir) {
+	const pnpmWorkspace = readYamlFile(dir, "pnpm-workspace.yaml");
+	if (pnpmWorkspace === void 0) return null;
+	return isObject(pnpmWorkspace) && isStringArray(pnpmWorkspace.packages) ? pnpmWorkspace.packages : ["**"];
+}
+function resolvePackageJsonGlobs(dir) {
+	const packageJson = readJsonFile(dir, "package.json");
+	if (!isObject(packageJson)) return null;
+	if (isStringArray(packageJson.workspaces)) return packageJson.workspaces;
+	if (isObject(packageJson.workspaces) && isStringArray(packageJson.workspaces.packages)) return packageJson.workspaces.packages;
+	if (isObject(packageJson.bolt) && isStringArray(packageJson.bolt.workspaces)) return packageJson.bolt.workspaces;
+	return null;
+}
+function readJsonFile(dir, file) {
+	try {
+		return JSON.parse((0, fs.readFileSync)((0, path.join)(dir, file), "utf8"));
+	} catch {
+		return;
+	}
+}
+function readYamlFile(dir, file) {
+	try {
+		return (0, yaml.parse)((0, fs.readFileSync)((0, path.join)(dir, file), "utf8"));
+	} catch {
+		return;
+	}
+}
+function toPosix(path$1) {
+	return path$1.split(path.sep).join(path.posix.sep);
+}
+function isObject(value) {
+	return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isStringArray(value) {
+	return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+//#endregion
+//#region src/bundler/workspaceDependencies.ts
+/**
 * Create a shared cache for find-workspaces
 */
-const workspacesCache = (0, find_workspaces.createWorkspacesCache)();
+const workspacesCache = createWorkspacesCache();
 /**
 * A utility function around find-workspaces to get information about:
 * - Which workspace packages are available in the project
@@ -143,7 +281,7 @@ const workspacesCache = (0, find_workspaces.createWorkspacesCache)();
 async function getWorkspaceInformation({ dir = process.cwd(), mastraEntryFile }) {
 	const closestPkgJson = empathic_package.up({ cwd: (0, path.dirname)(mastraEntryFile) });
 	const location = closestPkgJson ? (0, path.dirname)(require_utils.slash(closestPkgJson)) : require_utils.slash(process.cwd());
-	const workspaces = await (0, find_workspaces.findWorkspaces)(dir, { cache: workspacesCache });
+	const workspaces = await findWorkspaces(dir, { cache: workspacesCache });
 	const _workspaceMap = new Map(workspaces?.map((workspace) => [workspace.package.name, {
 		location: workspace.location,
 		dependencies: workspace.package.dependencies,
@@ -151,7 +289,7 @@ async function getWorkspaceInformation({ dir = process.cwd(), mastraEntryFile })
 		exports: workspace.package.exports
 	}]) ?? []);
 	const isWorkspacePackage = (workspaces ?? []).some((ws) => ws.location === location);
-	const workspaceRoot = isWorkspacePackage ? (0, find_workspaces.findWorkspacesRoot)(dir, { cache: workspacesCache })?.location : void 0;
+	const workspaceRoot = isWorkspacePackage ? findWorkspacesRoot(dir, { cache: workspacesCache })?.location : void 0;
 	return {
 		workspaceMap: isWorkspacePackage ? _workspaceMap : /* @__PURE__ */ new Map(),
 		workspaceRoot,
@@ -172,7 +310,7 @@ const collectTransitiveWorkspaceDependencies = async ({ workspaceMap, initialDep
 			if (!pkgName || usedWorkspacePackages.has(pkgName)) continue;
 			const dep = workspaceMap.get(pkgName);
 			if (!dep) continue;
-			const root = (0, find_workspaces.findWorkspacesRoot)();
+			const root = findWorkspacesRoot();
 			if (!root) throw new Error("Could not find workspace root");
 			const depsService = new require_services.DepsService(root.location);
 			depsService.__setLogger(logger);
@@ -180,7 +318,7 @@ const collectTransitiveWorkspaceDependencies = async ({ workspaceMap, initialDep
 			const sanitizedName = slugify(pkgName);
 			resolutions[pkgName] = depsService.getWorkspaceDependencyPath({
 				pkgName: sanitizedName,
-				version: dep.version
+				version: dep.version ?? "0.0.0"
 			});
 			usedWorkspacePackages.add(pkgName);
 			for (const [depName, _depVersion] of Object.entries(dep?.dependencies ?? {})) if (!usedWorkspacePackages.has(depName) && workspaceMap.has(depName)) queue.push(depName);
@@ -195,7 +333,7 @@ const collectTransitiveWorkspaceDependencies = async ({ workspaceMap, initialDep
 * Creates TGZ packages for workspace dependencies in the workspace-module directory
 */
 const packWorkspaceDependencies = async ({ workspaceMap, usedWorkspacePackages, bundleOutputDir, logger }) => {
-	const root = (0, find_workspaces.findWorkspacesRoot)();
+	const root = findWorkspacesRoot();
 	if (!root) throw new Error("Could not find workspace root");
 	const depsService = new require_services.DepsService(root.location);
 	depsService.__setLogger(logger);
@@ -206,21 +344,26 @@ const packWorkspaceDependencies = async ({ workspaceMap, usedWorkspacePackages,
 		logger.info("Packaging workspace dependencies", { count: usedWorkspacePackages.size });
 		const batchSize = 5;
 		const packages = Array.from(usedWorkspacePackages.values());
-		for (let i = 0; i < packages.length; i += batchSize) {
-			const batch = packages.slice(i, i + batchSize);
-			logger.info(`Packaging batch ${Math.floor(i / batchSize) + 1}/${Math.ceil(packages.length / batchSize)}: ${batch.join(", ")}`);
-			await Promise.all(batch.map(async (pkgName) => {
-				const dep = workspaceMap.get(pkgName);
-				const sanitizedName = slugify(pkgName);
-				if (!dep) return;
-				await depsService.pack({
-					dir: dep.location,
-					destination: workspaceDirPath,
-					sanitizedName,
-					version: dep.version
-				});
-			}));
-		}
+		await require_services.withPlaceholderVersions(packages.flatMap((pkgName) => {
+			const location = workspaceMap.get(pkgName)?.location;
+			return location ? [location] : [];
+		}), async () => {
+			for (let i = 0; i < packages.length; i += batchSize) {
+				const batch = packages.slice(i, i + batchSize);
+				logger.info(`Packaging batch ${Math.floor(i / batchSize) + 1}/${Math.ceil(packages.length / batchSize)}: ${batch.join(", ")}`);
+				await Promise.all(batch.map(async (pkgName) => {
+					const dep = workspaceMap.get(pkgName);
+					const sanitizedName = slugify(pkgName);
+					if (!dep) return;
+					await depsService.pack({
+						dir: dep.location,
+						destination: workspaceDirPath,
+						sanitizedName,
+						version: dep.version ?? "0.0.0"
+					});
+				}));
+			}
+		});
 		logger.info("Successfully packaged workspace dependencies", { count: usedWorkspacePackages.size });
 	}
 };
@@ -1493,4 +1636,4 @@ Object.defineProperty(exports, "packWorkspaceDependencies", {
 	}
 });
 
-//# sourceMappingURL=analyze-CcyVW_jJ.cjs.map
+//# sourceMappingURL=analyze-CPVTLGuy.cjs.map