@mastra/vercel 0.0.0

package/CHANGELOG.md

@@ -0,0 +1,25 @@
+# @mastra/vercel
+
+## 0.1.0-alpha.0
+
+### Minor Changes
+
+- Added Vercel serverless sandbox provider for executing commands as Vercel Functions. Deploys code as serverless functions and executes commands via HTTP invocation — providing globally-distributed, zero-infrastructure execution. ([#14710](https://github.com/mastra-ai/mastra/pull/14710))
+
+  **Usage:**
+
+  ```typescript
+  import { VercelSandbox } from '@mastra/vercel';
+  import { Workspace } from '@mastra/core/workspace';
+
+  const workspace = new Workspace({
+    sandbox: new VercelSandbox({
+      token: process.env.VERCEL_TOKEN,
+    }),
+  });
+  ```
+
+### Patch Changes
+
+- Updated dependencies [[`9140989`](https://github.com/mastra-ai/mastra/commit/91409890e83f4f1d9c1b39223f1af91a6a53b549), [`d7c98cf`](https://github.com/mastra-ai/mastra/commit/d7c98cfc9d75baba9ecbf1a8835b5183d0a0aec8), [`acf5fbc`](https://github.com/mastra-ai/mastra/commit/acf5fbcb890dc7ca7167bec386ce5874dfadb997), [`24ca2ae`](https://github.com/mastra-ai/mastra/commit/24ca2ae57538ec189fabb9daee6175ad27035853), [`0762516`](https://github.com/mastra-ai/mastra/commit/07625167e029a8268ea7aaf0402416e6d8832874), [`2de3d36`](https://github.com/mastra-ai/mastra/commit/2de3d36932b7f73ad26bc403f7da26cfe89e903e), [`d3736cb`](https://github.com/mastra-ai/mastra/commit/d3736cb9ce074d2b8e8b00218a01f790fe81a1b4), [`c627366`](https://github.com/mastra-ai/mastra/commit/c6273666f9ef4c8c617c68b7d07fe878a322f85c)]:
+  - @mastra/core@1.18.1-alpha.1

package/dist/executor/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Executor function source code deployed to Vercel as a serverless function.
+ *
+ * Returns a string because it's sent as inline file content via
+ * the Vercel Deployments API — no separate build step needed.
+ *
+ * The secret and user env vars are embedded as constants in the source
+ * because the Vercel Deployments API does not support setting env vars
+ * directly — they must be configured via vercel.json or project settings.
+ */
+export declare function getExecutorSource(secret: string, env: Record<string, string>): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/executor/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/executor/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CA6ErF"}

package/dist/index.cjs

@@ -0,0 +1,453 @@
+'use strict';
+
+var workspace = require('@mastra/core/workspace');
+
+// src/sandbox/index.ts
+
+// src/executor/index.ts
+function getExecutorSource(secret, env) {
+  const envEntries = Object.entries(env).map(([k, v]) => `  ${JSON.stringify(k)}: ${JSON.stringify(v)}`).join(",\n");
+  return `
+const { execFileSync } = require('child_process');
+
+const SANDBOX_SECRET = ${JSON.stringify(secret)};
+const SANDBOX_ENV = {
+${envEntries}
+};
+
+module.exports = async (req, res) => {
+  // Auth check
+  const authHeader = req.headers['authorization'] || '';
+  if (!SANDBOX_SECRET || authHeader !== 'Bearer ' + SANDBOX_SECRET) {
+    return res.status(401).json({ error: 'Unauthorized' });
+  }
+
+  if (req.method !== 'POST') {
+    return res.status(405).json({ error: 'Method not allowed' });
+  }
+
+  const { command, args = [], env = {}, cwd, timeout = 55000 } = req.body || {};
+
+  if (!command) {
+    return res.status(400).json({ error: 'Missing required field: command' });
+  }
+
+  const execCwd = cwd || '/tmp';
+  const execEnv = { ...process.env, ...SANDBOX_ENV, ...env };
+
+  // When args is empty the caller sent a full shell command string
+  // (e.g. "echo hello" or "ls -la | grep foo").  Run it through
+  // /bin/sh so builtins and pipes work.  When args is non-empty the
+  // caller split the command properly \u2014 use execFileSync to avoid
+  // shell injection.
+  const useShell = !args || args.length === 0;
+  const execCommand = useShell ? '/bin/sh' : command;
+  const execArgs = useShell ? ['-c', command] : args;
+
+  const startTime = Date.now();
+  let timedOut = false;
+
+  try {
+    const stdout = execFileSync(execCommand, execArgs, {
+      cwd: execCwd,
+      env: execEnv,
+      timeout,
+      maxBuffer: 10 * 1024 * 1024,
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+
+    return res.status(200).json({
+      success: true,
+      exitCode: 0,
+      stdout: stdout || '',
+      stderr: '',
+      executionTimeMs: Date.now() - startTime,
+      timedOut: false,
+    });
+  } catch (error) {
+    timedOut = error.killed || false;
+
+    return res.status(200).json({
+      success: false,
+      exitCode: error.status != null ? error.status : 1,
+      stdout: error.stdout || '',
+      stderr: error.stderr || '',
+      executionTimeMs: Date.now() - startTime,
+      timedOut,
+    });
+  }
+};
+`;
+}
+
+// src/sandbox/index.ts
+var LOG_PREFIX = "[VercelSandbox]";
+var VERCEL_API_BASE = "https://api.vercel.com";
+function shellQuote(arg) {
+  if (/^[a-zA-Z0-9._\-\/=:@]+$/.test(arg)) return arg;
+  return `'${arg.replace(/'/g, "'\\''")}'`;
+}
+var VercelSandbox = class extends workspace.MastraSandbox {
+  id;
+  name = "VercelSandbox";
+  provider = "vercel";
+  status = "pending";
+  _token;
+  _teamId;
+  _projectName;
+  _regions;
+  _maxDuration;
+  _memory;
+  _env;
+  _commandTimeout;
+  _instructionsOverride;
+  _secret;
+  _deploymentUrl = null;
+  _deploymentId = null;
+  _protectionBypass = null;
+  _createdAt = null;
+  constructor(options = {}) {
+    super({ name: "VercelSandbox" });
+    this.id = `vercel-sandbox-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+    this._token = options.token || process.env.VERCEL_TOKEN || "";
+    this._teamId = options.teamId;
+    this._projectName = options.projectName;
+    this._regions = options.regions ?? ["iad1"];
+    this._maxDuration = options.maxDuration ?? 60;
+    this._memory = options.memory ?? 1024;
+    this._env = options.env ?? {};
+    this._commandTimeout = options.commandTimeout ?? 55e3;
+    this._instructionsOverride = options.instructions;
+    this._secret = crypto.randomUUID();
+  }
+  // ---------------------------------------------------------------------------
+  // Lifecycle
+  // ---------------------------------------------------------------------------
+  async start() {
+    if (this._deploymentUrl) {
+      return;
+    }
+    if (!this._token) {
+      throw new Error(`${LOG_PREFIX} Missing Vercel API token. Set VERCEL_TOKEN env var or pass token option.`);
+    }
+    if (this._deploymentId) {
+      this.logger.debug(`${LOG_PREFIX} Cleaning up stale deployment ${this._deploymentId} before restarting...`);
+      try {
+        const resp = await this._vercelFetch(`/v13/deployments/${this._deploymentId}`, { method: "DELETE" });
+        if (!resp.ok && resp.status !== 404) {
+          this.logger.warn(`${LOG_PREFIX} Failed to delete stale deployment: ${resp.status}`);
+        }
+      } catch (error) {
+        this.logger.warn(`${LOG_PREFIX} Error deleting stale deployment:`, error);
+      }
+      this._deploymentId = null;
+    }
+    this.logger.debug(`${LOG_PREFIX} Deploying executor function...`);
+    const vercelJson = JSON.stringify({
+      functions: {
+        "api/execute.js": {
+          memory: this._memory,
+          maxDuration: this._maxDuration
+        }
+      },
+      regions: this._regions
+    });
+    const deploymentBody = {
+      name: this._projectName ?? `mastra-sandbox-${this.id}`,
+      files: [
+        {
+          file: "api/execute.js",
+          data: getExecutorSource(this._secret, this._env)
+        },
+        {
+          file: "vercel.json",
+          data: vercelJson
+        }
+      ],
+      projectSettings: {
+        framework: null
+      },
+      target: "production"
+    };
+    const createResp = await this._vercelFetch("/v13/deployments", {
+      method: "POST",
+      body: JSON.stringify(deploymentBody)
+    });
+    if (!createResp.ok) {
+      const errorBody = await createResp.text();
+      throw new Error(`${LOG_PREFIX} Failed to create deployment: ${createResp.status} ${errorBody}`);
+    }
+    const deployment = await createResp.json();
+    this._deploymentId = deployment.id;
+    this.logger.debug(`${LOG_PREFIX} Deployment created: ${deployment.id}, polling for READY...`);
+    const maxWaitMs = 12e4;
+    const pollIntervalMs = 3e3;
+    const deadline = Date.now() + maxWaitMs;
+    while (Date.now() < deadline) {
+      const statusResp = await this._vercelFetch(`/v13/deployments/${deployment.id}`);
+      if (!statusResp.ok) {
+        throw new Error(`${LOG_PREFIX} Failed to check deployment status: ${statusResp.status}`);
+      }
+      const statusBody = await statusResp.json();
+      if (statusBody.readyState === "READY") {
+        this._deploymentUrl = `https://${statusBody.url}`;
+        this._createdAt = /* @__PURE__ */ new Date();
+        this.logger.debug(`${LOG_PREFIX} Deployment ready: ${this._deploymentUrl}`);
+        if (deployment.projectId) {
+          try {
+            this._protectionBypass = await this._acquireProtectionBypass(deployment.projectId);
+          } catch {
+          }
+        }
+        try {
+          await fetch(`${this._deploymentUrl}/api/execute`, {
+            method: "POST",
+            headers: this._executorHeaders(),
+            body: JSON.stringify({ command: "echo", args: ["warm"] })
+          });
+        } catch {
+        }
+        return;
+      }
+      if (statusBody.readyState === "ERROR" || statusBody.readyState === "CANCELED") {
+        throw new Error(`${LOG_PREFIX} Deployment failed with state: ${statusBody.readyState}`);
+      }
+      await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    }
+    throw new Error(`${LOG_PREFIX} Deployment timed out after ${maxWaitMs}ms`);
+  }
+  async stop() {
+    this._deploymentUrl = null;
+  }
+  async destroy() {
+    if (this._deploymentId) {
+      try {
+        const resp = await this._vercelFetch(`/v13/deployments/${this._deploymentId}`, {
+          method: "DELETE"
+        });
+        if (!resp.ok) {
+          if (resp.status === 404) {
+            this.logger.debug(`${LOG_PREFIX} Deployment already deleted (404)`);
+          } else {
+            this.logger.warn(`${LOG_PREFIX} Failed to delete deployment: ${resp.status}`);
+          }
+        }
+      } catch (error) {
+        this.logger.warn(`${LOG_PREFIX} Error deleting deployment:`, error);
+      }
+      this._deploymentId = null;
+    }
+    this._deploymentUrl = null;
+    this._protectionBypass = null;
+  }
+  // ---------------------------------------------------------------------------
+  // Command Execution
+  // ---------------------------------------------------------------------------
+  async executeCommand(command, args, options) {
+    await this.ensureRunning();
+    if (!this._deploymentUrl) {
+      throw new workspace.SandboxNotReadyError(this.id);
+    }
+    const fullCommand = args?.length ? `${command} ${args.map((a) => shellQuote(a)).join(" ")}` : command;
+    this.logger.debug(`${LOG_PREFIX} Executing: ${fullCommand}`);
+    const body = {
+      command,
+      args: args ?? [],
+      env: options?.env ?? {},
+      cwd: options?.cwd ?? "/tmp",
+      timeout: options?.timeout ?? this._commandTimeout
+    };
+    const maxRetries = 2;
+    let lastError = null;
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+      try {
+        const resp = await fetch(`${this._deploymentUrl}/api/execute`, {
+          method: "POST",
+          headers: this._executorHeaders(),
+          body: JSON.stringify(body),
+          signal: options?.abortSignal
+        });
+        if ((resp.status === 429 || resp.status === 502 || resp.status === 503) && attempt < maxRetries) {
+          this.logger.debug(`${LOG_PREFIX} Retryable status ${resp.status}, attempt ${attempt + 1}/${maxRetries}`);
+          await new Promise((resolve) => setTimeout(resolve, 1e3 * (attempt + 1)));
+          continue;
+        }
+        if (resp.status === 504) {
+          return {
+            command: fullCommand,
+            args,
+            success: false,
+            exitCode: 124,
+            stdout: "",
+            stderr: "Function execution timed out (504 Gateway Timeout)",
+            executionTimeMs: options?.timeout ?? this._commandTimeout,
+            timedOut: true
+          };
+        }
+        if (!resp.ok) {
+          const errorText = await resp.text();
+          throw new Error(`${LOG_PREFIX} Execute failed: ${resp.status} ${errorText}`);
+        }
+        const result = await resp.json();
+        if (options?.onStdout && result.stdout) {
+          options.onStdout(result.stdout);
+        }
+        if (options?.onStderr && result.stderr) {
+          options.onStderr(result.stderr);
+        }
+        return {
+          command: fullCommand,
+          args,
+          success: result.success,
+          exitCode: result.exitCode,
+          stdout: result.stdout,
+          stderr: result.stderr,
+          executionTimeMs: result.executionTimeMs,
+          timedOut: result.timedOut
+        };
+      } catch (error) {
+        if (error instanceof DOMException && error.name === "AbortError") {
+          throw error;
+        }
+        lastError = error;
+        if (attempt < maxRetries) {
+          this.logger.debug(`${LOG_PREFIX} Request error, attempt ${attempt + 1}/${maxRetries}:`, error);
+          await new Promise((resolve) => setTimeout(resolve, 1e3 * (attempt + 1)));
+          continue;
+        }
+      }
+    }
+    throw lastError ?? new Error(`${LOG_PREFIX} executeCommand failed after retries`);
+  }
+  // ---------------------------------------------------------------------------
+  // Info & Instructions
+  // ---------------------------------------------------------------------------
+  // Matches the resolveInstructions pattern in packages/core/src/workspace/utils.ts
+  getInstructions(opts) {
+    if (this._instructionsOverride === void 0) return this._getDefaultInstructions();
+    if (typeof this._instructionsOverride === "string") return this._instructionsOverride;
+    const defaultInstructions = this._getDefaultInstructions();
+    return this._instructionsOverride({ defaultInstructions, requestContext: opts?.requestContext });
+  }
+  _getDefaultInstructions() {
+    return [
+      "Vercel serverless sandbox.",
+      "Limitations:",
+      "- Stateless: no persistent filesystem between invocations.",
+      "- No interactive shell or streaming stdin.",
+      "- No long-running or background processes.",
+      `- Maximum execution time: ${this._maxDuration} seconds.`,
+      "- Only /tmp is writable (ephemeral, cleared between invocations).",
+      "- Shell commands (pipes, builtins) are supported via /bin/sh -c."
+    ].join("\n");
+  }
+  async getInfo() {
+    return {
+      id: this.id,
+      name: this.name,
+      provider: this.provider,
+      status: this.status,
+      createdAt: this._createdAt ?? /* @__PURE__ */ new Date(),
+      metadata: {
+        deploymentId: this._deploymentId,
+        deploymentUrl: this._deploymentUrl,
+        regions: this._regions,
+        maxDuration: this._maxDuration,
+        memory: this._memory
+      }
+    };
+  }
+  // ---------------------------------------------------------------------------
+  // Private Helpers
+  // ---------------------------------------------------------------------------
+  /**
+   * Fetch an existing protection bypass token for the project, or create one
+   * if none exists. Returns the token string, or null if acquisition fails.
+   */
+  async _acquireProtectionBypass(projectId) {
+    const projResp = await this._vercelFetch(`/v9/projects/${projectId}`);
+    if (projResp.ok) {
+      const project = await projResp.json();
+      const existing = project.protectionBypass ? Object.keys(project.protectionBypass)[0] : void 0;
+      if (existing) {
+        this.logger.debug(`${LOG_PREFIX} Using existing protection bypass token`);
+        return existing;
+      }
+    }
+    this.logger.debug(`${LOG_PREFIX} Creating protection bypass token...`);
+    const createResp = await this._vercelFetch(`/v1/projects/${projectId}/protection-bypass`, {
+      method: "PATCH",
+      body: JSON.stringify({})
+    });
+    if (createResp.ok) {
+      const result = await createResp.json();
+      const created = result.protectionBypass ? Object.keys(result.protectionBypass)[0] : void 0;
+      if (created) {
+        this.logger.debug(`${LOG_PREFIX} Protection bypass token created`);
+        return created;
+      }
+    }
+    this.logger.debug(`${LOG_PREFIX} Could not acquire protection bypass token (project may not require it)`);
+    return null;
+  }
+  _executorHeaders() {
+    const headers = {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${this._secret}`
+    };
+    if (this._protectionBypass) {
+      headers["x-vercel-protection-bypass"] = this._protectionBypass;
+    }
+    return headers;
+  }
+  async _vercelFetch(path, options = {}) {
+    const url = new URL(path, VERCEL_API_BASE);
+    if (this._teamId) {
+      url.searchParams.set("teamId", this._teamId);
+    }
+    return fetch(url.toString(), {
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${this._token}`,
+        ...options.headers ?? {}
+      }
+    });
+  }
+};
+
+// src/provider.ts
+var vercelSandboxProvider = {
+  id: "vercel",
+  name: "Vercel Sandbox",
+  description: "Serverless sandbox powered by Vercel Functions",
+  configSchema: {
+    type: "object",
+    properties: {
+      token: { type: "string", description: "Vercel API token" },
+      teamId: { type: "string", description: "Vercel team ID" },
+      projectName: { type: "string", description: "Existing Vercel project name" },
+      regions: {
+        type: "array",
+        description: "Deployment regions",
+        items: { type: "string" },
+        default: ["iad1"]
+      },
+      maxDuration: { type: "number", description: "Function max duration in seconds", default: 60 },
+      memory: { type: "number", description: "Function memory in MB", default: 1024 },
+      env: {
+        type: "object",
+        description: "Environment variables",
+        additionalProperties: { type: "string" }
+      },
+      commandTimeout: { type: "number", description: "Per-invocation timeout in ms", default: 55e3 }
+    }
+  },
+  createSandbox: (config) => new VercelSandbox(config)
+};
+
+exports.VercelSandbox = VercelSandbox;
+exports.vercelSandboxProvider = vercelSandboxProvider;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/executor/index.ts","../src/sandbox/index.ts","../src/provider.ts"],"names":["MastraSandbox","SandboxNotReadyError"],"mappings":";;;;;;;AAUO,SAAS,iBAAA,CAAkB,QAAgB,GAAA,EAAqC;AACrF,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,CAClC,IAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,EAAA,EAAK,KAAK,SAAA,CAAU,CAAC,CAAC,CAAA,EAAA,EAAK,IAAA,CAAK,SAAA,CAAU,CAAC,CAAC,CAAA,CAAE,CAAA,CAC9D,IAAA,CAAK,KAAK,CAAA;AAEb,EAAA,OAAO;AAAA;;AAAA,uBAAA,EAGgB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AAAA;AAAA,EAE7C,UAAU;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAmEZ;;;ACjEA,IAAM,UAAA,GAAa,iBAAA;AAEnB,IAAM,eAAA,GAAkB,wBAAA;AAOxB,SAAS,WAAW,GAAA,EAAqB;AACvC,EAAA,IAAI,yBAAA,CAA0B,IAAA,CAAK,GAAG,CAAA,EAAG,OAAO,GAAA;AAChD,EAAA,OAAO,CAAA,CAAA,EAAI,GAAA,CAAI,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAC,CAAA,CAAA,CAAA;AACvC;AAkCO,IAAM,aAAA,GAAN,cAA4BA,uBAAA,CAAc;AAAA,EACtC,EAAA;AAAA,EACA,IAAA,GAAO,eAAA;AAAA,EACP,QAAA,GAAW,QAAA;AAAA,EACpB,MAAA,GAAyB,SAAA;AAAA,EAER,MAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,IAAA;AAAA,EACA,eAAA;AAAA,EACA,qBAAA;AAAA,EACA,OAAA;AAAA,EAET,cAAA,GAAgC,IAAA;AAAA,EAChC,aAAA,GAA+B,IAAA;AAAA,EAC/B,iBAAA,GAAmC,IAAA;AAAA,EACnC,UAAA,GAA0B,IAAA;AAAA,EAElC,WAAA,CAAY,OAAA,GAAgC,EAAC,EAAG;AAC9C,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,eAAA,EAAiB,CAAA;AAE/B,IAAA,IAAA,CAAK,KAAK,CAAA,eAAA,EAAkB,IAAA,CAAK,KAAI,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA,EAAI,IAAA,CAAK,MAAA,GAAS,QAAA,CAAS,EAAE,EAAE,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA;AAC7F,IAAA,IAAA,CAAK,MAAA,GAAS,OAAA,CAAQ,KAAA,IAAS,OAAA,CAAQ,IAAI,YAAA,IAAgB,EAAA;AAC3D,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,MAAA;AACvB,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,WAAA;AAC5B,IAAA,IAAA,CAAK,QAAA,GAAW,OAAA,CAAQ,OAAA,IAAW,CAAC,MAAM,CAAA;AAC1C,IAAA,IAAA,CAAK,YAAA,GAAe,QAAQ,WAAA,IAAe,EAAA;AAC3C,IAAA,IAAA,CAAK,OAAA,GAAU,QAAQ,MAAA,IAAU,IAAA;AACjC,IAAA,IAAA,CAAK,IAAA,GAAO,OAAA,CAAQ,GAAA,IAAO,EAAC;AAC5B,IAAA,IAAA,CAAK,eAAA,GAAkB,QAAQ,cAAA,IAAkB,IAAA;AACjD,IAAA,IAAA,CAAK,wBAAwB,OAAA,CAAQ,YAAA;AACrC,IAAA,IAAA,CAAK,OAAA,GAAU,OAAO,UAAA,EAAW;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,yEAAA,CAA2E,CAAA;AAAA,IAC1G;AAIA,IAAA,IAAI,KAAK,aAAA,EAAe;AACtB,MAAA,IAAA,CAAK,OAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,8BAAA,EAAiC,IAAA,CAAK,aAAa,CAAA,qBAAA,CAAuB,CAAA;AACzG,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,YAAA,CAAa,CAAA,iBAAA,EAAoB,IAAA,CAAK,aAAa,CAAA,CAAA,EAAI,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AACnG,QAAA,IAAI,CAAC,IAAA,CAAK,EAAA,IAAM,IAAA,CAAK,WAAW,GAAA,EAAK;AACnC,UAAA,IAAA,CAAK,OAAO,IAAA,CAAK,CAAA,EAAG,UAAU,CAAA,oCAAA,EAAuC,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,QACpF;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,UAAU,qCAAqC,KAAK,CAAA;AAAA,MAC1E;AACA,MAAA,IAAA,CAAK,aAAA,GAAgB,IAAA;AAAA,IACvB;AAEA,IAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,+BAAA,CAAiC,CAAA;AAEhE,IAAA,MAAM,UAAA,GAAa,KAAK,SAAA,CAAU;AAAA,MAChC,SAAA,EAAW;AAAA,QACT,gBAAA,EAAkB;AAAA,UAChB,QAAQ,IAAA,CAAK,OAAA;AAAA,UACb,aAAa,IAAA,CAAK;AAAA;AACpB,OACF;AAAA,MACA,SAAS,IAAA,CAAK;AAAA,KACf,CAAA;AAGD,IAAA,MAAM,cAAA,GAA0C;AAAA,MAC9C,IAAA,EAAM,IAAA,CAAK,YAAA,IAAgB,CAAA,eAAA,EAAkB,KAAK,EAAE,CAAA,CAAA;AAAA,MACpD,KAAA,EAAO;AAAA,QACL;AAAA,UACE,IAAA,EAAM,gBAAA;AAAA,UACN,IAAA,EAAM,iBAAA,CAAkB,IAAA,CAAK,OAAA,EAAS,KAAK,IAAI;AAAA,SACjD;AAAA,QACA;AAAA,UACE,IAAA,EAAM,aAAA;AAAA,UACN,IAAA,EAAM;AAAA;AACR,OACF;AAAA,MACA,eAAA,EAAiB;AAAA,QACf,SAAA,EAAW;AAAA,OACb;AAAA,MACA,MAAA,EAAQ;AAAA,KACV;AAEA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAAa,kBAAA,EAAoB;AAAA,MAC7D,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,cAAc;AAAA,KACpC,CAAA;AAED,IAAA,IAAI,CAAC,WAAW,EAAA,EAAI;AAClB,MAAA,MAAM,SAAA,GAAY,MAAM,UAAA,CAAW,IAAA,EAAK;AACxC,MAAA,MAAM,IAAI,MAAM,CAAA,EAAG,UAAU,iCAAiC,UAAA,CAAW,MAAM,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AAAA,IAChG;AAEA,IAAA,MAAM,UAAA,GAAc,MAAM,UAAA,CAAW,IAAA,EAAK;AAC1C,IAAA,IAAA,CAAK,gBAAgB,UAAA,CAAW,EAAA;AAEhC,IAAA,IAAA,CAAK,OAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,qBAAA,EAAwB,UAAA,CAAW,EAAE,CAAA,sBAAA,CAAwB,CAAA;AAG5F,IAAA,MAAM,SAAA,GAAY,IAAA;AAClB,IAAA,MAAM,cAAA,GAAiB,GAAA;AACvB,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAE9B,IAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,MAAA,MAAM,aAAa,MAAM,IAAA,CAAK,aAAa,CAAA,iBAAA,EAAoB,UAAA,CAAW,EAAE,CAAA,CAAE,CAAA;AAC9E,MAAA,IAAI,CAAC,WAAW,EAAA,EAAI;AAClB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,oCAAA,EAAuC,UAAA,CAAW,MAAM,CAAA,CAAE,CAAA;AAAA,MACzF;AAEA,MAAA,MAAM,UAAA,GAAc,MAAM,UAAA,CAAW,IAAA,EAAK;AAE1C,MAAA,IAAI,UAAA,CAAW,eAAe,OAAA,EAAS;AACrC,QAAA,IAAA,CAAK,cAAA,GAAiB,CAAA,QAAA,EAAW,UAAA,CAAW,GAAG,CAAA,CAAA;AAC/C,QAAA,IAAA,CAAK,UAAA,uBAAiB,IAAA,EAAK;AAC3B,QAAA,IAAA,CAAK,OAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,mBAAA,EAAsB,IAAA,CAAK,cAAc,CAAA,CAAE,CAAA;AAM1E,QAAA,IAAI,WAAW,SAAA,EAAW;AACxB,UAAA,IAAI;AACF,YAAA,IAAA,CAAK,iBAAA,GAAoB,MAAM,IAAA,CAAK,wBAAA,CAAyB,WAAW,SAAS,CAAA;AAAA,UACnF,CAAA,CAAA,MAAQ;AAAA,UAER;AAAA,QACF;AAGA,QAAA,IAAI;AACF,UAAA,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,cAAc,CAAA,YAAA,CAAA,EAAgB;AAAA,YAChD,MAAA,EAAQ,MAAA;AAAA,YACR,OAAA,EAAS,KAAK,gBAAA,EAAiB;AAAA,YAC/B,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,OAAA,EAAS,QAAQ,IAAA,EAAM,CAAC,MAAM,CAAA,EAAG;AAAA,WACzD,CAAA;AAAA,QACH,CAAA,CAAA,MAAQ;AAAA,QAER;AAEA,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,UAAA,CAAW,UAAA,KAAe,OAAA,IAAW,UAAA,CAAW,eAAe,UAAA,EAAY;AAC7E,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,+BAAA,EAAkC,UAAA,CAAW,UAAU,CAAA,CAAE,CAAA;AAAA,MACxF;AAEA,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAA,OAAA,KAAW,UAAA,CAAW,OAAA,EAAS,cAAc,CAAC,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,4BAAA,EAA+B,SAAS,CAAA,EAAA,CAAI,CAAA;AAAA,EAC3E;AAAA,EAEA,MAAM,IAAA,GAAsB;AAK1B,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AAAA,EACxB;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,IAAI,KAAK,aAAA,EAAe;AACtB,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,MAAM,IAAA,CAAK,aAAa,CAAA,iBAAA,EAAoB,IAAA,CAAK,aAAa,CAAA,CAAA,EAAI;AAAA,UAC7E,MAAA,EAAQ;AAAA,SACT,CAAA;AACD,QAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AAIZ,UAAA,IAAI,IAAA,CAAK,WAAW,GAAA,EAAK;AACvB,YAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,iCAAA,CAAmC,CAAA;AAAA,UACpE,CAAA,MAAO;AACL,YAAA,IAAA,CAAK,OAAO,IAAA,CAAK,CAAA,EAAG,UAAU,CAAA,8BAAA,EAAiC,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,UAC9E;AAAA,QACF;AAAA,MACF,SAAS,KAAA,EAAO;AAEd,QAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,UAAU,+BAA+B,KAAK,CAAA;AAAA,MACpE;AACA,MAAA,IAAA,CAAK,aAAA,GAAgB,IAAA;AAAA,IACvB;AACA,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,IAAA,IAAA,CAAK,iBAAA,GAAoB,IAAA;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,cAAA,CAAe,OAAA,EAAiB,IAAA,EAAiB,OAAA,EAAyD;AAC9G,IAAA,MAAM,KAAK,aAAA,EAAc;AAEzB,IAAA,IAAI,CAAC,KAAK,cAAA,EAAgB;AACxB,MAAA,MAAM,IAAIC,8BAAA,CAAqB,IAAA,CAAK,EAAE,CAAA;AAAA,IACxC;AAEA,IAAA,MAAM,cAAc,IAAA,EAAM,MAAA,GAAS,CAAA,EAAG,OAAO,IAAI,IAAA,CAAK,GAAA,CAAI,CAAA,CAAA,KAAK,UAAA,CAAW,CAAC,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,GAAK,OAAA;AAC5F,IAAA,IAAA,CAAK,OAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,YAAA,EAAe,WAAW,CAAA,CAAE,CAAA;AAE3D,IAAA,MAAM,IAAA,GAAO;AAAA,MACX,OAAA;AAAA,MACA,IAAA,EAAM,QAAQ,EAAC;AAAA,MACf,GAAA,EAAK,OAAA,EAAS,GAAA,IAAO,EAAC;AAAA,MACtB,GAAA,EAAK,SAAS,GAAA,IAAO,MAAA;AAAA,MACrB,OAAA,EAAS,OAAA,EAAS,OAAA,IAAW,IAAA,CAAK;AAAA,KACpC;AAEA,IAAA,MAAM,UAAA,GAAa,CAAA;AACnB,IAAA,IAAI,SAAA,GAA0B,IAAA;AAE9B,IAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,UAAA,EAAY,OAAA,EAAA,EAAW;AACtD,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,cAAc,CAAA,YAAA,CAAA,EAAgB;AAAA,UAC7D,MAAA,EAAQ,MAAA;AAAA,UACR,OAAA,EAAS,KAAK,gBAAA,EAAiB;AAAA,UAC/B,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAAA,UACzB,QAAQ,OAAA,EAAS;AAAA,SAClB,CAAA;AAGD,QAAA,IAAA,CAAK,IAAA,CAAK,MAAA,KAAW,GAAA,IAAO,IAAA,CAAK,MAAA,KAAW,OAAO,IAAA,CAAK,MAAA,KAAW,GAAA,KAAQ,OAAA,GAAU,UAAA,EAAY;AAC/F,UAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,kBAAA,EAAqB,IAAA,CAAK,MAAM,CAAA,UAAA,EAAa,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,UAAU,CAAA,CAAE,CAAA;AACvG,UAAA,MAAM,IAAI,QAAQ,CAAA,OAAA,KAAW,UAAA,CAAW,SAAS,GAAA,IAAQ,OAAA,GAAU,EAAE,CAAC,CAAA;AACtE,UAAA;AAAA,QACF;AAGA,QAAA,IAAI,IAAA,CAAK,WAAW,GAAA,EAAK;AACvB,UAAA,OAAO;AAAA,YACL,OAAA,EAAS,WAAA;AAAA,YACT,IAAA;AAAA,YACA,OAAA,EAAS,KAAA;AAAA,YACT,QAAA,EAAU,GAAA;AAAA,YACV,MAAA,EAAQ,EAAA;AAAA,YACR,MAAA,EAAQ,oDAAA;AAAA,YACR,eAAA,EAAiB,OAAA,EAAS,OAAA,IAAW,IAAA,CAAK,eAAA;AAAA,YAC1C,QAAA,EAAU;AAAA,WACZ;AAAA,QACF;AAEA,QAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACZ,UAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,IAAA,EAAK;AAClC,UAAA,MAAM,IAAI,MAAM,CAAA,EAAG,UAAU,oBAAoB,IAAA,CAAK,MAAM,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AAAA,QAC7E;AAEA,QAAA,MAAM,MAAA,GAAU,MAAM,IAAA,CAAK,IAAA,EAAK;AAUhC,QAAA,IAAI,OAAA,EAAS,QAAA,IAAY,MAAA,CAAO,MAAA,EAAQ;AACtC,UAAA,OAAA,CAAQ,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,QAChC;AACA,QAAA,IAAI,OAAA,EAAS,QAAA,IAAY,MAAA,CAAO,MAAA,EAAQ;AACtC,UAAA,OAAA,CAAQ,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,QAChC;AAEA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS,WAAA;AAAA,UACT,IAAA;AAAA,UACA,SAAS,MAAA,CAAO,OAAA;AAAA,UAChB,UAAU,MAAA,CAAO,QAAA;AAAA,UACjB,QAAQ,MAAA,CAAO,MAAA;AAAA,UACf,QAAQ,MAAA,CAAO,MAAA;AAAA,UACf,iBAAiB,MAAA,CAAO,eAAA;AAAA,UACxB,UAAU,MAAA,CAAO;AAAA,SACnB;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,KAAA,YAAiB,YAAA,IAAgB,KAAA,CAAM,IAAA,KAAS,YAAA,EAAc;AAChE,UAAA,MAAM,KAAA;AAAA,QACR;AACA,QAAA,SAAA,GAAY,KAAA;AACZ,QAAA,IAAI,UAAU,UAAA,EAAY;AACxB,UAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,wBAAA,EAA2B,UAAU,CAAC,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA,CAAA,EAAK,KAAK,CAAA;AAC7F,UAAA,MAAM,IAAI,QAAQ,CAAA,OAAA,KAAW,UAAA,CAAW,SAAS,GAAA,IAAQ,OAAA,GAAU,EAAE,CAAC,CAAA;AACtE,UAAA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,IAAa,IAAI,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,oCAAA,CAAsC,CAAA;AAAA,EAClF;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB,IAAA,EAAoD;AAClE,IAAA,IAAI,IAAA,CAAK,qBAAA,KAA0B,MAAA,EAAW,OAAO,KAAK,uBAAA,EAAwB;AAClF,IAAA,IAAI,OAAO,IAAA,CAAK,qBAAA,KAA0B,QAAA,SAAiB,IAAA,CAAK,qBAAA;AAChE,IAAA,MAAM,mBAAA,GAAsB,KAAK,uBAAA,EAAwB;AACzD,IAAA,OAAO,KAAK,qBAAA,CAAsB,EAAE,qBAAqB,cAAA,EAAgB,IAAA,EAAM,gBAAgB,CAAA;AAAA,EACjG;AAAA,EAEQ,uBAAA,GAAkC;AACxC,IAAA,OAAO;AAAA,MACL,4BAAA;AAAA,MACA,cAAA;AAAA,MACA,4DAAA;AAAA,MACA,4CAAA;AAAA,MACA,4CAAA;AAAA,MACA,CAAA,0BAAA,EAA6B,KAAK,YAAY,CAAA,SAAA,CAAA;AAAA,MAC9C,mEAAA;AAAA,MACA;AAAA,KACF,CAAE,KAAK,IAAI,CAAA;AAAA,EACb;AAAA,EAEA,MAAM,OAAA,GAAgC;AACpC,IAAA,OAAO;AAAA,MACL,IAAI,IAAA,CAAK,EAAA;AAAA,MACT,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,SAAA,EAAW,IAAA,CAAK,UAAA,oBAAc,IAAI,IAAA,EAAK;AAAA,MACvC,QAAA,EAAU;AAAA,QACR,cAAc,IAAA,CAAK,aAAA;AAAA,QACnB,eAAe,IAAA,CAAK,cAAA;AAAA,QACpB,SAAS,IAAA,CAAK,QAAA;AAAA,QACd,aAAa,IAAA,CAAK,YAAA;AAAA,QAClB,QAAQ,IAAA,CAAK;AAAA;AACf,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,yBAAyB,SAAA,EAA2C;AAEhF,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,YAAA,CAAa,CAAA,aAAA,EAAgB,SAAS,CAAA,CAAE,CAAA;AACpE,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,MAAM,OAAA,GAAW,MAAM,QAAA,CAAS,IAAA,EAAK;AAGrC,MAAA,MAAM,QAAA,GAAW,QAAQ,gBAAA,GAAmB,MAAA,CAAO,KAAK,OAAA,CAAQ,gBAAgB,CAAA,CAAE,CAAC,CAAA,GAAI,MAAA;AACvF,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,uCAAA,CAAyC,CAAA;AACxE,QAAA,OAAO,QAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,oCAAA,CAAsC,CAAA;AACrE,IAAA,MAAM,aAAa,MAAM,IAAA,CAAK,YAAA,CAAa,CAAA,aAAA,EAAgB,SAAS,CAAA,kBAAA,CAAA,EAAsB;AAAA,MACxF,MAAA,EAAQ,OAAA;AAAA,MACR,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE;AAAA,KACxB,CAAA;AACD,IAAA,IAAI,WAAW,EAAA,EAAI;AACjB,MAAA,MAAM,MAAA,GAAU,MAAM,UAAA,CAAW,IAAA,EAAK;AAGtC,MAAA,MAAM,OAAA,GAAU,OAAO,gBAAA,GAAmB,MAAA,CAAO,KAAK,MAAA,CAAO,gBAAgB,CAAA,CAAE,CAAC,CAAA,GAAI,MAAA;AACpF,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,gCAAA,CAAkC,CAAA;AACjE,QAAA,OAAO,OAAA;AAAA,MACT;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,uEAAA,CAAyE,CAAA;AACxG,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEQ,gBAAA,GAA2C;AACjD,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,cAAA,EAAgB,kBAAA;AAAA,MAChB,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,OAAO,CAAA;AAAA,KACvC;AACA,IAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,MAAA,OAAA,CAAQ,4BAA4B,IAAI,IAAA,CAAK,iBAAA;AAAA,IAC/C;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAc,YAAA,CAAa,IAAA,EAAc,OAAA,GAAuB,EAAC,EAAsB;AACrF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,EAAM,eAAe,CAAA;AACzC,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,IAAA,CAAK,OAAO,CAAA;AAAA,IAC7C;AAEA,IAAA,OAAO,KAAA,CAAM,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,MAC3B,GAAG,OAAA;AAAA,MACH,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAAA;AAAA,QACpC,GAAK,OAAA,CAAQ,OAAA,IAAsC;AAAC;AACtD,KACD,CAAA;AAAA,EACH;AACF;;;ACrcO,IAAM,qBAAA,GAA+D;AAAA,EAC1E,EAAA,EAAI,QAAA;AAAA,EACJ,IAAA,EAAM,gBAAA;AAAA,EACN,WAAA,EAAa,gDAAA;AAAA,EACb,YAAA,EAAc;AAAA,IACZ,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,kBAAA,EAAmB;AAAA,MACzD,MAAA,EAAQ,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,gBAAA,EAAiB;AAAA,MACxD,WAAA,EAAa,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,8BAAA,EAA+B;AAAA,MAC3E,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,OAAA;AAAA,QACN,WAAA,EAAa,oBAAA;AAAA,QACb,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,QACxB,OAAA,EAAS,CAAC,MAAM;AAAA,OAClB;AAAA,MACA,aAAa,EAAE,IAAA,EAAM,UAAU,WAAA,EAAa,kCAAA,EAAoC,SAAS,EAAA,EAAG;AAAA,MAC5F,QAAQ,EAAE,IAAA,EAAM,UAAU,WAAA,EAAa,uBAAA,EAAyB,SAAS,IAAA,EAAK;AAAA,MAC9E,GAAA,EAAK;AAAA,QACH,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa,uBAAA;AAAA,QACb,oBAAA,EAAsB,EAAE,IAAA,EAAM,QAAA;AAAS,OACzC;AAAA,MACA,gBAAgB,EAAE,IAAA,EAAM,UAAU,WAAA,EAAa,8BAAA,EAAgC,SAAS,IAAA;AAAM;AAChG,GACF;AAAA,EACA,aAAA,EAAe,CAAA,MAAA,KAAU,IAAI,aAAA,CAAc,MAAM;AACnD","file":"index.cjs","sourcesContent":["/**\n * Executor function source code deployed to Vercel as a serverless function.\n *\n * Returns a string because it's sent as inline file content via\n * the Vercel Deployments API — no separate build step needed.\n *\n * The secret and user env vars are embedded as constants in the source\n * because the Vercel Deployments API does not support setting env vars\n * directly — they must be configured via vercel.json or project settings.\n */\nexport function getExecutorSource(secret: string, env: Record<string, string>): string {\n  const envEntries = Object.entries(env)\n    .map(([k, v]) => `  ${JSON.stringify(k)}: ${JSON.stringify(v)}`)\n    .join(',\\n');\n\n  return `\nconst { execFileSync } = require('child_process');\n\nconst SANDBOX_SECRET = ${JSON.stringify(secret)};\nconst SANDBOX_ENV = {\n${envEntries}\n};\n\nmodule.exports = async (req, res) => {\n  // Auth check\n  const authHeader = req.headers['authorization'] || '';\n  if (!SANDBOX_SECRET || authHeader !== 'Bearer ' + SANDBOX_SECRET) {\n    return res.status(401).json({ error: 'Unauthorized' });\n  }\n\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' });\n  }\n\n  const { command, args = [], env = {}, cwd, timeout = 55000 } = req.body || {};\n\n  if (!command) {\n    return res.status(400).json({ error: 'Missing required field: command' });\n  }\n\n  const execCwd = cwd || '/tmp';\n  const execEnv = { ...process.env, ...SANDBOX_ENV, ...env };\n\n  // When args is empty the caller sent a full shell command string\n  // (e.g. \"echo hello\" or \"ls -la | grep foo\").  Run it through\n  // /bin/sh so builtins and pipes work.  When args is non-empty the\n  // caller split the command properly — use execFileSync to avoid\n  // shell injection.\n  const useShell = !args || args.length === 0;\n  const execCommand = useShell ? '/bin/sh' : command;\n  const execArgs = useShell ? ['-c', command] : args;\n\n  const startTime = Date.now();\n  let timedOut = false;\n\n  try {\n    const stdout = execFileSync(execCommand, execArgs, {\n      cwd: execCwd,\n      env: execEnv,\n      timeout,\n      maxBuffer: 10 * 1024 * 1024,\n      encoding: 'utf-8',\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n\n    return res.status(200).json({\n      success: true,\n      exitCode: 0,\n      stdout: stdout || '',\n      stderr: '',\n      executionTimeMs: Date.now() - startTime,\n      timedOut: false,\n    });\n  } catch (error) {\n    timedOut = error.killed || false;\n\n    return res.status(200).json({\n      success: false,\n      exitCode: error.status != null ? error.status : 1,\n      stdout: error.stdout || '',\n      stderr: error.stderr || '',\n      executionTimeMs: Date.now() - startTime,\n      timedOut,\n    });\n  }\n};\n`;\n}\n","/**\n * Vercel Sandbox Provider\n *\n * Deploys code as Vercel serverless functions and executes commands\n * via HTTP invocation. Stateless — no persistent filesystem, no\n * interactive shell, no long-running processes.\n *\n * @see https://vercel.com/docs/rest-api\n */\n\nimport type { RequestContext } from '@mastra/core/di';\nimport type {\n  SandboxInfo,\n  CommandResult,\n  ExecuteCommandOptions,\n  MastraSandboxOptions,\n  ProviderStatus,\n  InstructionsOption,\n} from '@mastra/core/workspace';\nimport { MastraSandbox, SandboxNotReadyError } from '@mastra/core/workspace';\nimport { getExecutorSource } from '../executor';\n\nconst LOG_PREFIX = '[VercelSandbox]';\n\nconst VERCEL_API_BASE = 'https://api.vercel.com';\n\n/**\n * Shell-quote an argument for safe interpolation into a shell command string.\n * Mirrors the implementation in packages/core/src/workspace/sandbox/utils.ts\n * which is not publicly exported.\n */\nfunction shellQuote(arg: string): string {\n  if (/^[a-zA-Z0-9._\\-\\/=:@]+$/.test(arg)) return arg;\n  return `'${arg.replace(/'/g, \"'\\\\''\")}'`;\n}\n\n// =============================================================================\n// Options\n// =============================================================================\n\nexport interface VercelSandboxOptions extends Omit<MastraSandboxOptions, 'processes'> {\n  /** Vercel API token. Falls back to VERCEL_TOKEN env var. */\n  token?: string;\n  /** Vercel team ID for team-scoped deployments. */\n  teamId?: string;\n  /** Existing Vercel project name. Auto-generated if omitted. */\n  projectName?: string;\n  /** Deployment regions. @default ['iad1'] */\n  regions?: string[];\n  /** Function max duration in seconds. @default 60 */\n  maxDuration?: number;\n  /** Function memory in MB. @default 1024 */\n  memory?: number;\n  /** Environment variables baked into the deployed function. */\n  env?: Record<string, string>;\n  /** Per-invocation command timeout in ms. @default 55000 */\n  commandTimeout?: number;\n  /**\n   * Custom instructions that override the default instructions\n   * returned by `getInstructions()`.\n   */\n  instructions?: InstructionsOption;\n}\n\n// =============================================================================\n// Implementation\n// =============================================================================\n\nexport class VercelSandbox extends MastraSandbox {\n  readonly id: string;\n  readonly name = 'VercelSandbox';\n  readonly provider = 'vercel';\n  status: ProviderStatus = 'pending';\n\n  private readonly _token: string;\n  private readonly _teamId?: string;\n  private readonly _projectName?: string;\n  private readonly _regions: string[];\n  private readonly _maxDuration: number;\n  private readonly _memory: number;\n  private readonly _env: Record<string, string>;\n  private readonly _commandTimeout: number;\n  private readonly _instructionsOverride?: InstructionsOption;\n  private readonly _secret: string;\n\n  private _deploymentUrl: string | null = null;\n  private _deploymentId: string | null = null;\n  private _protectionBypass: string | null = null;\n  private _createdAt: Date | null = null;\n\n  constructor(options: VercelSandboxOptions = {}) {\n    super({ name: 'VercelSandbox' });\n\n    this.id = `vercel-sandbox-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;\n    this._token = options.token || process.env.VERCEL_TOKEN || '';\n    this._teamId = options.teamId;\n    this._projectName = options.projectName;\n    this._regions = options.regions ?? ['iad1'];\n    this._maxDuration = options.maxDuration ?? 60;\n    this._memory = options.memory ?? 1024;\n    this._env = options.env ?? {};\n    this._commandTimeout = options.commandTimeout ?? 55_000;\n    this._instructionsOverride = options.instructions;\n    this._secret = crypto.randomUUID();\n  }\n\n  // ---------------------------------------------------------------------------\n  // Lifecycle\n  // ---------------------------------------------------------------------------\n\n  async start(): Promise<void> {\n    if (this._deploymentUrl) {\n      return;\n    }\n\n    if (!this._token) {\n      throw new Error(`${LOG_PREFIX} Missing Vercel API token. Set VERCEL_TOKEN env var or pass token option.`);\n    }\n\n    // Clean up any stale deployment from a previous stop() → start() cycle.\n    // Without this, the old _deploymentId is overwritten and that deployment leaks.\n    if (this._deploymentId) {\n      this.logger.debug(`${LOG_PREFIX} Cleaning up stale deployment ${this._deploymentId} before restarting...`);\n      try {\n        const resp = await this._vercelFetch(`/v13/deployments/${this._deploymentId}`, { method: 'DELETE' });\n        if (!resp.ok && resp.status !== 404) {\n          this.logger.warn(`${LOG_PREFIX} Failed to delete stale deployment: ${resp.status}`);\n        }\n      } catch (error) {\n        this.logger.warn(`${LOG_PREFIX} Error deleting stale deployment:`, error);\n      }\n      this._deploymentId = null;\n    }\n\n    this.logger.debug(`${LOG_PREFIX} Deploying executor function...`);\n\n    const vercelJson = JSON.stringify({\n      functions: {\n        'api/execute.js': {\n          memory: this._memory,\n          maxDuration: this._maxDuration,\n        },\n      },\n      regions: this._regions,\n    });\n\n    // Create the deployment\n    const deploymentBody: Record<string, unknown> = {\n      name: this._projectName ?? `mastra-sandbox-${this.id}`,\n      files: [\n        {\n          file: 'api/execute.js',\n          data: getExecutorSource(this._secret, this._env),\n        },\n        {\n          file: 'vercel.json',\n          data: vercelJson,\n        },\n      ],\n      projectSettings: {\n        framework: null,\n      },\n      target: 'production',\n    };\n\n    const createResp = await this._vercelFetch('/v13/deployments', {\n      method: 'POST',\n      body: JSON.stringify(deploymentBody),\n    });\n\n    if (!createResp.ok) {\n      const errorBody = await createResp.text();\n      throw new Error(`${LOG_PREFIX} Failed to create deployment: ${createResp.status} ${errorBody}`);\n    }\n\n    const deployment = (await createResp.json()) as { id: string; url: string; readyState: string; projectId?: string };\n    this._deploymentId = deployment.id;\n\n    this.logger.debug(`${LOG_PREFIX} Deployment created: ${deployment.id}, polling for READY...`);\n\n    // Poll until ready\n    const maxWaitMs = 120_000;\n    const pollIntervalMs = 3_000;\n    const deadline = Date.now() + maxWaitMs;\n\n    while (Date.now() < deadline) {\n      const statusResp = await this._vercelFetch(`/v13/deployments/${deployment.id}`);\n      if (!statusResp.ok) {\n        throw new Error(`${LOG_PREFIX} Failed to check deployment status: ${statusResp.status}`);\n      }\n\n      const statusBody = (await statusResp.json()) as { readyState: string; url: string };\n\n      if (statusBody.readyState === 'READY') {\n        this._deploymentUrl = `https://${statusBody.url}`;\n        this._createdAt = new Date();\n        this.logger.debug(`${LOG_PREFIX} Deployment ready: ${this._deploymentUrl}`);\n\n        // Acquire a deployment protection bypass token.\n        // Pro/Enterprise teams have Deployment Protection enabled by default,\n        // which intercepts HTTP requests with an SSO login page before they\n        // reach the serverless function. The bypass token lets us skip that.\n        if (deployment.projectId) {\n          try {\n            this._protectionBypass = await this._acquireProtectionBypass(deployment.projectId);\n          } catch {\n            // Non-fatal — if the project has no deployment protection, this is unnecessary.\n          }\n        }\n\n        // Warm-up ping\n        try {\n          await fetch(`${this._deploymentUrl}/api/execute`, {\n            method: 'POST',\n            headers: this._executorHeaders(),\n            body: JSON.stringify({ command: 'echo', args: ['warm'] }),\n          });\n        } catch {\n          // Warm-up failure is non-fatal\n        }\n\n        return;\n      }\n\n      if (statusBody.readyState === 'ERROR' || statusBody.readyState === 'CANCELED') {\n        throw new Error(`${LOG_PREFIX} Deployment failed with state: ${statusBody.readyState}`);\n      }\n\n      await new Promise(resolve => setTimeout(resolve, pollIntervalMs));\n    }\n\n    throw new Error(`${LOG_PREFIX} Deployment timed out after ${maxWaitMs}ms`);\n  }\n\n  async stop(): Promise<void> {\n    // Only clear the URL (disconnects from the deployment) but keep\n    // _deploymentId so a subsequent destroy() can still clean up the\n    // cloud resource. Clearing both would make destroy() a no-op and\n    // leak the deployment.\n    this._deploymentUrl = null;\n  }\n\n  async destroy(): Promise<void> {\n    if (this._deploymentId) {\n      try {\n        const resp = await this._vercelFetch(`/v13/deployments/${this._deploymentId}`, {\n          method: 'DELETE',\n        });\n        if (!resp.ok) {\n          // 404 means the deployment is already gone — that's fine.\n          // Other status codes indicate infrastructure issues (auth, network)\n          // and should be surfaced more visibly.\n          if (resp.status === 404) {\n            this.logger.debug(`${LOG_PREFIX} Deployment already deleted (404)`);\n          } else {\n            this.logger.warn(`${LOG_PREFIX} Failed to delete deployment: ${resp.status}`);\n          }\n        }\n      } catch (error) {\n        // Network-level failure — warn rather than debug so it's visible\n        this.logger.warn(`${LOG_PREFIX} Error deleting deployment:`, error);\n      }\n      this._deploymentId = null;\n    }\n    this._deploymentUrl = null;\n    this._protectionBypass = null;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Command Execution\n  // ---------------------------------------------------------------------------\n\n  async executeCommand(command: string, args?: string[], options?: ExecuteCommandOptions): Promise<CommandResult> {\n    await this.ensureRunning();\n\n    if (!this._deploymentUrl) {\n      throw new SandboxNotReadyError(this.id);\n    }\n\n    const fullCommand = args?.length ? `${command} ${args.map(a => shellQuote(a)).join(' ')}` : command;\n    this.logger.debug(`${LOG_PREFIX} Executing: ${fullCommand}`);\n\n    const body = {\n      command,\n      args: args ?? [],\n      env: options?.env ?? {},\n      cwd: options?.cwd ?? '/tmp',\n      timeout: options?.timeout ?? this._commandTimeout,\n    };\n\n    const maxRetries = 2;\n    let lastError: Error | null = null;\n\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\n      try {\n        const resp = await fetch(`${this._deploymentUrl}/api/execute`, {\n          method: 'POST',\n          headers: this._executorHeaders(),\n          body: JSON.stringify(body),\n          signal: options?.abortSignal,\n        });\n\n        // Retry on transient errors\n        if ((resp.status === 429 || resp.status === 502 || resp.status === 503) && attempt < maxRetries) {\n          this.logger.debug(`${LOG_PREFIX} Retryable status ${resp.status}, attempt ${attempt + 1}/${maxRetries}`);\n          await new Promise(resolve => setTimeout(resolve, 1000 * (attempt + 1)));\n          continue;\n        }\n\n        // Gateway timeout → timedOut\n        if (resp.status === 504) {\n          return {\n            command: fullCommand,\n            args,\n            success: false,\n            exitCode: 124,\n            stdout: '',\n            stderr: 'Function execution timed out (504 Gateway Timeout)',\n            executionTimeMs: options?.timeout ?? this._commandTimeout,\n            timedOut: true,\n          };\n        }\n\n        if (!resp.ok) {\n          const errorText = await resp.text();\n          throw new Error(`${LOG_PREFIX} Execute failed: ${resp.status} ${errorText}`);\n        }\n\n        const result = (await resp.json()) as {\n          success: boolean;\n          exitCode: number;\n          stdout: string;\n          stderr: string;\n          executionTimeMs: number;\n          timedOut: boolean;\n        };\n\n        // Stream callbacks\n        if (options?.onStdout && result.stdout) {\n          options.onStdout(result.stdout);\n        }\n        if (options?.onStderr && result.stderr) {\n          options.onStderr(result.stderr);\n        }\n\n        return {\n          command: fullCommand,\n          args,\n          success: result.success,\n          exitCode: result.exitCode,\n          stdout: result.stdout,\n          stderr: result.stderr,\n          executionTimeMs: result.executionTimeMs,\n          timedOut: result.timedOut,\n        };\n      } catch (error) {\n        if (error instanceof DOMException && error.name === 'AbortError') {\n          throw error;\n        }\n        lastError = error as Error;\n        if (attempt < maxRetries) {\n          this.logger.debug(`${LOG_PREFIX} Request error, attempt ${attempt + 1}/${maxRetries}:`, error);\n          await new Promise(resolve => setTimeout(resolve, 1000 * (attempt + 1)));\n          continue;\n        }\n      }\n    }\n\n    throw lastError ?? new Error(`${LOG_PREFIX} executeCommand failed after retries`);\n  }\n\n  // ---------------------------------------------------------------------------\n  // Info & Instructions\n  // ---------------------------------------------------------------------------\n\n  // Matches the resolveInstructions pattern in packages/core/src/workspace/utils.ts\n  getInstructions(opts?: { requestContext?: RequestContext }): string {\n    if (this._instructionsOverride === undefined) return this._getDefaultInstructions();\n    if (typeof this._instructionsOverride === 'string') return this._instructionsOverride;\n    const defaultInstructions = this._getDefaultInstructions();\n    return this._instructionsOverride({ defaultInstructions, requestContext: opts?.requestContext });\n  }\n\n  private _getDefaultInstructions(): string {\n    return [\n      'Vercel serverless sandbox.',\n      'Limitations:',\n      '- Stateless: no persistent filesystem between invocations.',\n      '- No interactive shell or streaming stdin.',\n      '- No long-running or background processes.',\n      `- Maximum execution time: ${this._maxDuration} seconds.`,\n      '- Only /tmp is writable (ephemeral, cleared between invocations).',\n      '- Shell commands (pipes, builtins) are supported via /bin/sh -c.',\n    ].join('\\n');\n  }\n\n  async getInfo(): Promise<SandboxInfo> {\n    return {\n      id: this.id,\n      name: this.name,\n      provider: this.provider,\n      status: this.status,\n      createdAt: this._createdAt ?? new Date(),\n      metadata: {\n        deploymentId: this._deploymentId,\n        deploymentUrl: this._deploymentUrl,\n        regions: this._regions,\n        maxDuration: this._maxDuration,\n        memory: this._memory,\n      },\n    };\n  }\n\n  // ---------------------------------------------------------------------------\n  // Private Helpers\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Fetch an existing protection bypass token for the project, or create one\n   * if none exists. Returns the token string, or null if acquisition fails.\n   */\n  private async _acquireProtectionBypass(projectId: string): Promise<string | null> {\n    // 1. Check if the project already has a bypass token.\n    const projResp = await this._vercelFetch(`/v9/projects/${projectId}`);\n    if (projResp.ok) {\n      const project = (await projResp.json()) as {\n        protectionBypass?: Record<string, unknown>;\n      };\n      const existing = project.protectionBypass ? Object.keys(project.protectionBypass)[0] : undefined;\n      if (existing) {\n        this.logger.debug(`${LOG_PREFIX} Using existing protection bypass token`);\n        return existing;\n      }\n    }\n\n    // 2. No token exists — create one via the dedicated endpoint.\n    this.logger.debug(`${LOG_PREFIX} Creating protection bypass token...`);\n    const createResp = await this._vercelFetch(`/v1/projects/${projectId}/protection-bypass`, {\n      method: 'PATCH',\n      body: JSON.stringify({}),\n    });\n    if (createResp.ok) {\n      const result = (await createResp.json()) as {\n        protectionBypass?: Record<string, unknown>;\n      };\n      const created = result.protectionBypass ? Object.keys(result.protectionBypass)[0] : undefined;\n      if (created) {\n        this.logger.debug(`${LOG_PREFIX} Protection bypass token created`);\n        return created;\n      }\n    }\n\n    this.logger.debug(`${LOG_PREFIX} Could not acquire protection bypass token (project may not require it)`);\n    return null;\n  }\n\n  private _executorHeaders(): Record<string, string> {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      Authorization: `Bearer ${this._secret}`,\n    };\n    if (this._protectionBypass) {\n      headers['x-vercel-protection-bypass'] = this._protectionBypass;\n    }\n    return headers;\n  }\n\n  private async _vercelFetch(path: string, options: RequestInit = {}): Promise<Response> {\n    const url = new URL(path, VERCEL_API_BASE);\n    if (this._teamId) {\n      url.searchParams.set('teamId', this._teamId);\n    }\n\n    return fetch(url.toString(), {\n      ...options,\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${this._token}`,\n        ...((options.headers as Record<string, string>) ?? {}),\n      },\n    });\n  }\n}\n","/**\n * Vercel sandbox provider descriptor for MastraEditor.\n *\n * @example\n * ```typescript\n * import { vercelSandboxProvider } from '@mastra/vercel';\n *\n * const editor = new MastraEditor({\n *   sandboxes: [vercelSandboxProvider],\n * });\n * ```\n */\nimport type { SandboxProvider } from '@mastra/core/editor';\nimport { VercelSandbox } from './sandbox';\n\n/**\n * Serializable subset of VercelSandboxOptions for editor storage.\n */\ninterface VercelProviderConfig {\n  token?: string;\n  teamId?: string;\n  projectName?: string;\n  regions?: string[];\n  maxDuration?: number;\n  memory?: number;\n  env?: Record<string, string>;\n  commandTimeout?: number;\n}\n\nexport const vercelSandboxProvider: SandboxProvider<VercelProviderConfig> = {\n  id: 'vercel',\n  name: 'Vercel Sandbox',\n  description: 'Serverless sandbox powered by Vercel Functions',\n  configSchema: {\n    type: 'object',\n    properties: {\n      token: { type: 'string', description: 'Vercel API token' },\n      teamId: { type: 'string', description: 'Vercel team ID' },\n      projectName: { type: 'string', description: 'Existing Vercel project name' },\n      regions: {\n        type: 'array',\n        description: 'Deployment regions',\n        items: { type: 'string' },\n        default: ['iad1'],\n      },\n      maxDuration: { type: 'number', description: 'Function max duration in seconds', default: 60 },\n      memory: { type: 'number', description: 'Function memory in MB', default: 1024 },\n      env: {\n        type: 'object',\n        description: 'Environment variables',\n        additionalProperties: { type: 'string' },\n      },\n      commandTimeout: { type: 'number', description: 'Per-invocation timeout in ms', default: 55000 },\n    },\n  },\n  createSandbox: config => new VercelSandbox(config),\n};\n"]}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { VercelSandbox, type VercelSandboxOptions } from './sandbox/index.js';
+export { vercelSandboxProvider } from './provider.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,450 @@
+import { MastraSandbox, SandboxNotReadyError } from '@mastra/core/workspace';
+
+// src/sandbox/index.ts
+
+// src/executor/index.ts
+function getExecutorSource(secret, env) {
+  const envEntries = Object.entries(env).map(([k, v]) => `  ${JSON.stringify(k)}: ${JSON.stringify(v)}`).join(",\n");
+  return `
+const { execFileSync } = require('child_process');
+
+const SANDBOX_SECRET = ${JSON.stringify(secret)};
+const SANDBOX_ENV = {
+${envEntries}
+};
+
+module.exports = async (req, res) => {
+  // Auth check
+  const authHeader = req.headers['authorization'] || '';
+  if (!SANDBOX_SECRET || authHeader !== 'Bearer ' + SANDBOX_SECRET) {
+    return res.status(401).json({ error: 'Unauthorized' });
+  }
+
+  if (req.method !== 'POST') {
+    return res.status(405).json({ error: 'Method not allowed' });
+  }
+
+  const { command, args = [], env = {}, cwd, timeout = 55000 } = req.body || {};
+
+  if (!command) {
+    return res.status(400).json({ error: 'Missing required field: command' });
+  }
+
+  const execCwd = cwd || '/tmp';
+  const execEnv = { ...process.env, ...SANDBOX_ENV, ...env };
+
+  // When args is empty the caller sent a full shell command string
+  // (e.g. "echo hello" or "ls -la | grep foo").  Run it through
+  // /bin/sh so builtins and pipes work.  When args is non-empty the
+  // caller split the command properly \u2014 use execFileSync to avoid
+  // shell injection.
+  const useShell = !args || args.length === 0;
+  const execCommand = useShell ? '/bin/sh' : command;
+  const execArgs = useShell ? ['-c', command] : args;
+
+  const startTime = Date.now();
+  let timedOut = false;
+
+  try {
+    const stdout = execFileSync(execCommand, execArgs, {
+      cwd: execCwd,
+      env: execEnv,
+      timeout,
+      maxBuffer: 10 * 1024 * 1024,
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+
+    return res.status(200).json({
+      success: true,
+      exitCode: 0,
+      stdout: stdout || '',
+      stderr: '',
+      executionTimeMs: Date.now() - startTime,
+      timedOut: false,
+    });
+  } catch (error) {
+    timedOut = error.killed || false;
+
+    return res.status(200).json({
+      success: false,
+      exitCode: error.status != null ? error.status : 1,
+      stdout: error.stdout || '',
+      stderr: error.stderr || '',
+      executionTimeMs: Date.now() - startTime,
+      timedOut,
+    });
+  }
+};
+`;
+}
+
+// src/sandbox/index.ts
+var LOG_PREFIX = "[VercelSandbox]";
+var VERCEL_API_BASE = "https://api.vercel.com";
+function shellQuote(arg) {
+  if (/^[a-zA-Z0-9._\-\/=:@]+$/.test(arg)) return arg;
+  return `'${arg.replace(/'/g, "'\\''")}'`;
+}
+var VercelSandbox = class extends MastraSandbox {
+  id;
+  name = "VercelSandbox";
+  provider = "vercel";
+  status = "pending";
+  _token;
+  _teamId;
+  _projectName;
+  _regions;
+  _maxDuration;
+  _memory;
+  _env;
+  _commandTimeout;
+  _instructionsOverride;
+  _secret;
+  _deploymentUrl = null;
+  _deploymentId = null;
+  _protectionBypass = null;
+  _createdAt = null;
+  constructor(options = {}) {
+    super({ name: "VercelSandbox" });
+    this.id = `vercel-sandbox-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+    this._token = options.token || process.env.VERCEL_TOKEN || "";
+    this._teamId = options.teamId;
+    this._projectName = options.projectName;
+    this._regions = options.regions ?? ["iad1"];
+    this._maxDuration = options.maxDuration ?? 60;
+    this._memory = options.memory ?? 1024;
+    this._env = options.env ?? {};
+    this._commandTimeout = options.commandTimeout ?? 55e3;
+    this._instructionsOverride = options.instructions;
+    this._secret = crypto.randomUUID();
+  }
+  // ---------------------------------------------------------------------------
+  // Lifecycle
+  // ---------------------------------------------------------------------------
+  async start() {
+    if (this._deploymentUrl) {
+      return;
+    }
+    if (!this._token) {
+      throw new Error(`${LOG_PREFIX} Missing Vercel API token. Set VERCEL_TOKEN env var or pass token option.`);
+    }
+    if (this._deploymentId) {
+      this.logger.debug(`${LOG_PREFIX} Cleaning up stale deployment ${this._deploymentId} before restarting...`);
+      try {
+        const resp = await this._vercelFetch(`/v13/deployments/${this._deploymentId}`, { method: "DELETE" });
+        if (!resp.ok && resp.status !== 404) {
+          this.logger.warn(`${LOG_PREFIX} Failed to delete stale deployment: ${resp.status}`);
+        }
+      } catch (error) {
+        this.logger.warn(`${LOG_PREFIX} Error deleting stale deployment:`, error);
+      }
+      this._deploymentId = null;
+    }
+    this.logger.debug(`${LOG_PREFIX} Deploying executor function...`);
+    const vercelJson = JSON.stringify({
+      functions: {
+        "api/execute.js": {
+          memory: this._memory,
+          maxDuration: this._maxDuration
+        }
+      },
+      regions: this._regions
+    });
+    const deploymentBody = {
+      name: this._projectName ?? `mastra-sandbox-${this.id}`,
+      files: [
+        {
+          file: "api/execute.js",
+          data: getExecutorSource(this._secret, this._env)
+        },
+        {
+          file: "vercel.json",
+          data: vercelJson
+        }
+      ],
+      projectSettings: {
+        framework: null
+      },
+      target: "production"
+    };
+    const createResp = await this._vercelFetch("/v13/deployments", {
+      method: "POST",
+      body: JSON.stringify(deploymentBody)
+    });
+    if (!createResp.ok) {
+      const errorBody = await createResp.text();
+      throw new Error(`${LOG_PREFIX} Failed to create deployment: ${createResp.status} ${errorBody}`);
+    }
+    const deployment = await createResp.json();
+    this._deploymentId = deployment.id;
+    this.logger.debug(`${LOG_PREFIX} Deployment created: ${deployment.id}, polling for READY...`);
+    const maxWaitMs = 12e4;
+    const pollIntervalMs = 3e3;
+    const deadline = Date.now() + maxWaitMs;
+    while (Date.now() < deadline) {
+      const statusResp = await this._vercelFetch(`/v13/deployments/${deployment.id}`);
+      if (!statusResp.ok) {
+        throw new Error(`${LOG_PREFIX} Failed to check deployment status: ${statusResp.status}`);
+      }
+      const statusBody = await statusResp.json();
+      if (statusBody.readyState === "READY") {
+        this._deploymentUrl = `https://${statusBody.url}`;
+        this._createdAt = /* @__PURE__ */ new Date();
+        this.logger.debug(`${LOG_PREFIX} Deployment ready: ${this._deploymentUrl}`);
+        if (deployment.projectId) {
+          try {
+            this._protectionBypass = await this._acquireProtectionBypass(deployment.projectId);
+          } catch {
+          }
+        }
+        try {
+          await fetch(`${this._deploymentUrl}/api/execute`, {
+            method: "POST",
+            headers: this._executorHeaders(),
+            body: JSON.stringify({ command: "echo", args: ["warm"] })
+          });
+        } catch {
+        }
+        return;
+      }
+      if (statusBody.readyState === "ERROR" || statusBody.readyState === "CANCELED") {
+        throw new Error(`${LOG_PREFIX} Deployment failed with state: ${statusBody.readyState}`);
+      }
+      await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    }
+    throw new Error(`${LOG_PREFIX} Deployment timed out after ${maxWaitMs}ms`);
+  }
+  async stop() {
+    this._deploymentUrl = null;
+  }
+  async destroy() {
+    if (this._deploymentId) {
+      try {
+        const resp = await this._vercelFetch(`/v13/deployments/${this._deploymentId}`, {
+          method: "DELETE"
+        });
+        if (!resp.ok) {
+          if (resp.status === 404) {
+            this.logger.debug(`${LOG_PREFIX} Deployment already deleted (404)`);
+          } else {
+            this.logger.warn(`${LOG_PREFIX} Failed to delete deployment: ${resp.status}`);
+          }
+        }
+      } catch (error) {
+        this.logger.warn(`${LOG_PREFIX} Error deleting deployment:`, error);
+      }
+      this._deploymentId = null;
+    }
+    this._deploymentUrl = null;
+    this._protectionBypass = null;
+  }
+  // ---------------------------------------------------------------------------
+  // Command Execution
+  // ---------------------------------------------------------------------------
+  async executeCommand(command, args, options) {
+    await this.ensureRunning();
+    if (!this._deploymentUrl) {
+      throw new SandboxNotReadyError(this.id);
+    }
+    const fullCommand = args?.length ? `${command} ${args.map((a) => shellQuote(a)).join(" ")}` : command;
+    this.logger.debug(`${LOG_PREFIX} Executing: ${fullCommand}`);
+    const body = {
+      command,
+      args: args ?? [],
+      env: options?.env ?? {},
+      cwd: options?.cwd ?? "/tmp",
+      timeout: options?.timeout ?? this._commandTimeout
+    };
+    const maxRetries = 2;
+    let lastError = null;
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+      try {
+        const resp = await fetch(`${this._deploymentUrl}/api/execute`, {
+          method: "POST",
+          headers: this._executorHeaders(),
+          body: JSON.stringify(body),
+          signal: options?.abortSignal
+        });
+        if ((resp.status === 429 || resp.status === 502 || resp.status === 503) && attempt < maxRetries) {
+          this.logger.debug(`${LOG_PREFIX} Retryable status ${resp.status}, attempt ${attempt + 1}/${maxRetries}`);
+          await new Promise((resolve) => setTimeout(resolve, 1e3 * (attempt + 1)));
+          continue;
+        }
+        if (resp.status === 504) {
+          return {
+            command: fullCommand,
+            args,
+            success: false,
+            exitCode: 124,
+            stdout: "",
+            stderr: "Function execution timed out (504 Gateway Timeout)",
+            executionTimeMs: options?.timeout ?? this._commandTimeout,
+            timedOut: true
+          };
+        }
+        if (!resp.ok) {
+          const errorText = await resp.text();
+          throw new Error(`${LOG_PREFIX} Execute failed: ${resp.status} ${errorText}`);
+        }
+        const result = await resp.json();
+        if (options?.onStdout && result.stdout) {
+          options.onStdout(result.stdout);
+        }
+        if (options?.onStderr && result.stderr) {
+          options.onStderr(result.stderr);
+        }
+        return {
+          command: fullCommand,
+          args,
+          success: result.success,
+          exitCode: result.exitCode,
+          stdout: result.stdout,
+          stderr: result.stderr,
+          executionTimeMs: result.executionTimeMs,
+          timedOut: result.timedOut
+        };
+      } catch (error) {
+        if (error instanceof DOMException && error.name === "AbortError") {
+          throw error;
+        }
+        lastError = error;
+        if (attempt < maxRetries) {
+          this.logger.debug(`${LOG_PREFIX} Request error, attempt ${attempt + 1}/${maxRetries}:`, error);
+          await new Promise((resolve) => setTimeout(resolve, 1e3 * (attempt + 1)));
+          continue;
+        }
+      }
+    }
+    throw lastError ?? new Error(`${LOG_PREFIX} executeCommand failed after retries`);
+  }
+  // ---------------------------------------------------------------------------
+  // Info & Instructions
+  // ---------------------------------------------------------------------------
+  // Matches the resolveInstructions pattern in packages/core/src/workspace/utils.ts
+  getInstructions(opts) {
+    if (this._instructionsOverride === void 0) return this._getDefaultInstructions();
+    if (typeof this._instructionsOverride === "string") return this._instructionsOverride;
+    const defaultInstructions = this._getDefaultInstructions();
+    return this._instructionsOverride({ defaultInstructions, requestContext: opts?.requestContext });
+  }
+  _getDefaultInstructions() {
+    return [
+      "Vercel serverless sandbox.",
+      "Limitations:",
+      "- Stateless: no persistent filesystem between invocations.",
+      "- No interactive shell or streaming stdin.",
+      "- No long-running or background processes.",
+      `- Maximum execution time: ${this._maxDuration} seconds.`,
+      "- Only /tmp is writable (ephemeral, cleared between invocations).",
+      "- Shell commands (pipes, builtins) are supported via /bin/sh -c."
+    ].join("\n");
+  }
+  async getInfo() {
+    return {
+      id: this.id,
+      name: this.name,
+      provider: this.provider,
+      status: this.status,
+      createdAt: this._createdAt ?? /* @__PURE__ */ new Date(),
+      metadata: {
+        deploymentId: this._deploymentId,
+        deploymentUrl: this._deploymentUrl,
+        regions: this._regions,
+        maxDuration: this._maxDuration,
+        memory: this._memory
+      }
+    };
+  }
+  // ---------------------------------------------------------------------------
+  // Private Helpers
+  // ---------------------------------------------------------------------------
+  /**
+   * Fetch an existing protection bypass token for the project, or create one
+   * if none exists. Returns the token string, or null if acquisition fails.
+   */
+  async _acquireProtectionBypass(projectId) {
+    const projResp = await this._vercelFetch(`/v9/projects/${projectId}`);
+    if (projResp.ok) {
+      const project = await projResp.json();
+      const existing = project.protectionBypass ? Object.keys(project.protectionBypass)[0] : void 0;
+      if (existing) {
+        this.logger.debug(`${LOG_PREFIX} Using existing protection bypass token`);
+        return existing;
+      }
+    }
+    this.logger.debug(`${LOG_PREFIX} Creating protection bypass token...`);
+    const createResp = await this._vercelFetch(`/v1/projects/${projectId}/protection-bypass`, {
+      method: "PATCH",
+      body: JSON.stringify({})
+    });
+    if (createResp.ok) {
+      const result = await createResp.json();
+      const created = result.protectionBypass ? Object.keys(result.protectionBypass)[0] : void 0;
+      if (created) {
+        this.logger.debug(`${LOG_PREFIX} Protection bypass token created`);
+        return created;
+      }
+    }
+    this.logger.debug(`${LOG_PREFIX} Could not acquire protection bypass token (project may not require it)`);
+    return null;
+  }
+  _executorHeaders() {
+    const headers = {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${this._secret}`
+    };
+    if (this._protectionBypass) {
+      headers["x-vercel-protection-bypass"] = this._protectionBypass;
+    }
+    return headers;
+  }
+  async _vercelFetch(path, options = {}) {
+    const url = new URL(path, VERCEL_API_BASE);
+    if (this._teamId) {
+      url.searchParams.set("teamId", this._teamId);
+    }
+    return fetch(url.toString(), {
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${this._token}`,
+        ...options.headers ?? {}
+      }
+    });
+  }
+};
+
+// src/provider.ts
+var vercelSandboxProvider = {
+  id: "vercel",
+  name: "Vercel Sandbox",
+  description: "Serverless sandbox powered by Vercel Functions",
+  configSchema: {
+    type: "object",
+    properties: {
+      token: { type: "string", description: "Vercel API token" },
+      teamId: { type: "string", description: "Vercel team ID" },
+      projectName: { type: "string", description: "Existing Vercel project name" },
+      regions: {
+        type: "array",
+        description: "Deployment regions",
+        items: { type: "string" },
+        default: ["iad1"]
+      },
+      maxDuration: { type: "number", description: "Function max duration in seconds", default: 60 },
+      memory: { type: "number", description: "Function memory in MB", default: 1024 },
+      env: {
+        type: "object",
+        description: "Environment variables",
+        additionalProperties: { type: "string" }
+      },
+      commandTimeout: { type: "number", description: "Per-invocation timeout in ms", default: 55e3 }
+    }
+  },
+  createSandbox: (config) => new VercelSandbox(config)
+};
+
+export { VercelSandbox, vercelSandboxProvider };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/executor/index.ts","../src/sandbox/index.ts","../src/provider.ts"],"names":[],"mappings":";;;;;AAUO,SAAS,iBAAA,CAAkB,QAAgB,GAAA,EAAqC;AACrF,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,CAClC,IAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,EAAA,EAAK,KAAK,SAAA,CAAU,CAAC,CAAC,CAAA,EAAA,EAAK,IAAA,CAAK,SAAA,CAAU,CAAC,CAAC,CAAA,CAAE,CAAA,CAC9D,IAAA,CAAK,KAAK,CAAA;AAEb,EAAA,OAAO;AAAA;;AAAA,uBAAA,EAGgB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AAAA;AAAA,EAE7C,UAAU;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAmEZ;;;ACjEA,IAAM,UAAA,GAAa,iBAAA;AAEnB,IAAM,eAAA,GAAkB,wBAAA;AAOxB,SAAS,WAAW,GAAA,EAAqB;AACvC,EAAA,IAAI,yBAAA,CAA0B,IAAA,CAAK,GAAG,CAAA,EAAG,OAAO,GAAA;AAChD,EAAA,OAAO,CAAA,CAAA,EAAI,GAAA,CAAI,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAC,CAAA,CAAA,CAAA;AACvC;AAkCO,IAAM,aAAA,GAAN,cAA4B,aAAA,CAAc;AAAA,EACtC,EAAA;AAAA,EACA,IAAA,GAAO,eAAA;AAAA,EACP,QAAA,GAAW,QAAA;AAAA,EACpB,MAAA,GAAyB,SAAA;AAAA,EAER,MAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,IAAA;AAAA,EACA,eAAA;AAAA,EACA,qBAAA;AAAA,EACA,OAAA;AAAA,EAET,cAAA,GAAgC,IAAA;AAAA,EAChC,aAAA,GAA+B,IAAA;AAAA,EAC/B,iBAAA,GAAmC,IAAA;AAAA,EACnC,UAAA,GAA0B,IAAA;AAAA,EAElC,WAAA,CAAY,OAAA,GAAgC,EAAC,EAAG;AAC9C,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,eAAA,EAAiB,CAAA;AAE/B,IAAA,IAAA,CAAK,KAAK,CAAA,eAAA,EAAkB,IAAA,CAAK,KAAI,CAAE,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA,EAAI,IAAA,CAAK,MAAA,GAAS,QAAA,CAAS,EAAE,EAAE,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA;AAC7F,IAAA,IAAA,CAAK,MAAA,GAAS,OAAA,CAAQ,KAAA,IAAS,OAAA,CAAQ,IAAI,YAAA,IAAgB,EAAA;AAC3D,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,MAAA;AACvB,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,WAAA;AAC5B,IAAA,IAAA,CAAK,QAAA,GAAW,OAAA,CAAQ,OAAA,IAAW,CAAC,MAAM,CAAA;AAC1C,IAAA,IAAA,CAAK,YAAA,GAAe,QAAQ,WAAA,IAAe,EAAA;AAC3C,IAAA,IAAA,CAAK,OAAA,GAAU,QAAQ,MAAA,IAAU,IAAA;AACjC,IAAA,IAAA,CAAK,IAAA,GAAO,OAAA,CAAQ,GAAA,IAAO,EAAC;AAC5B,IAAA,IAAA,CAAK,eAAA,GAAkB,QAAQ,cAAA,IAAkB,IAAA;AACjD,IAAA,IAAA,CAAK,wBAAwB,OAAA,CAAQ,YAAA;AACrC,IAAA,IAAA,CAAK,OAAA,GAAU,OAAO,UAAA,EAAW;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,yEAAA,CAA2E,CAAA;AAAA,IAC1G;AAIA,IAAA,IAAI,KAAK,aAAA,EAAe;AACtB,MAAA,IAAA,CAAK,OAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,8BAAA,EAAiC,IAAA,CAAK,aAAa,CAAA,qBAAA,CAAuB,CAAA;AACzG,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,YAAA,CAAa,CAAA,iBAAA,EAAoB,IAAA,CAAK,aAAa,CAAA,CAAA,EAAI,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AACnG,QAAA,IAAI,CAAC,IAAA,CAAK,EAAA,IAAM,IAAA,CAAK,WAAW,GAAA,EAAK;AACnC,UAAA,IAAA,CAAK,OAAO,IAAA,CAAK,CAAA,EAAG,UAAU,CAAA,oCAAA,EAAuC,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,QACpF;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,UAAU,qCAAqC,KAAK,CAAA;AAAA,MAC1E;AACA,MAAA,IAAA,CAAK,aAAA,GAAgB,IAAA;AAAA,IACvB;AAEA,IAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,+BAAA,CAAiC,CAAA;AAEhE,IAAA,MAAM,UAAA,GAAa,KAAK,SAAA,CAAU;AAAA,MAChC,SAAA,EAAW;AAAA,QACT,gBAAA,EAAkB;AAAA,UAChB,QAAQ,IAAA,CAAK,OAAA;AAAA,UACb,aAAa,IAAA,CAAK;AAAA;AACpB,OACF;AAAA,MACA,SAAS,IAAA,CAAK;AAAA,KACf,CAAA;AAGD,IAAA,MAAM,cAAA,GAA0C;AAAA,MAC9C,IAAA,EAAM,IAAA,CAAK,YAAA,IAAgB,CAAA,eAAA,EAAkB,KAAK,EAAE,CAAA,CAAA;AAAA,MACpD,KAAA,EAAO;AAAA,QACL;AAAA,UACE,IAAA,EAAM,gBAAA;AAAA,UACN,IAAA,EAAM,iBAAA,CAAkB,IAAA,CAAK,OAAA,EAAS,KAAK,IAAI;AAAA,SACjD;AAAA,QACA;AAAA,UACE,IAAA,EAAM,aAAA;AAAA,UACN,IAAA,EAAM;AAAA;AACR,OACF;AAAA,MACA,eAAA,EAAiB;AAAA,QACf,SAAA,EAAW;AAAA,OACb;AAAA,MACA,MAAA,EAAQ;AAAA,KACV;AAEA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAAa,kBAAA,EAAoB;AAAA,MAC7D,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,cAAc;AAAA,KACpC,CAAA;AAED,IAAA,IAAI,CAAC,WAAW,EAAA,EAAI;AAClB,MAAA,MAAM,SAAA,GAAY,MAAM,UAAA,CAAW,IAAA,EAAK;AACxC,MAAA,MAAM,IAAI,MAAM,CAAA,EAAG,UAAU,iCAAiC,UAAA,CAAW,MAAM,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AAAA,IAChG;AAEA,IAAA,MAAM,UAAA,GAAc,MAAM,UAAA,CAAW,IAAA,EAAK;AAC1C,IAAA,IAAA,CAAK,gBAAgB,UAAA,CAAW,EAAA;AAEhC,IAAA,IAAA,CAAK,OAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,qBAAA,EAAwB,UAAA,CAAW,EAAE,CAAA,sBAAA,CAAwB,CAAA;AAG5F,IAAA,MAAM,SAAA,GAAY,IAAA;AAClB,IAAA,MAAM,cAAA,GAAiB,GAAA;AACvB,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAE9B,IAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,MAAA,MAAM,aAAa,MAAM,IAAA,CAAK,aAAa,CAAA,iBAAA,EAAoB,UAAA,CAAW,EAAE,CAAA,CAAE,CAAA;AAC9E,MAAA,IAAI,CAAC,WAAW,EAAA,EAAI;AAClB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,oCAAA,EAAuC,UAAA,CAAW,MAAM,CAAA,CAAE,CAAA;AAAA,MACzF;AAEA,MAAA,MAAM,UAAA,GAAc,MAAM,UAAA,CAAW,IAAA,EAAK;AAE1C,MAAA,IAAI,UAAA,CAAW,eAAe,OAAA,EAAS;AACrC,QAAA,IAAA,CAAK,cAAA,GAAiB,CAAA,QAAA,EAAW,UAAA,CAAW,GAAG,CAAA,CAAA;AAC/C,QAAA,IAAA,CAAK,UAAA,uBAAiB,IAAA,EAAK;AAC3B,QAAA,IAAA,CAAK,OAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,mBAAA,EAAsB,IAAA,CAAK,cAAc,CAAA,CAAE,CAAA;AAM1E,QAAA,IAAI,WAAW,SAAA,EAAW;AACxB,UAAA,IAAI;AACF,YAAA,IAAA,CAAK,iBAAA,GAAoB,MAAM,IAAA,CAAK,wBAAA,CAAyB,WAAW,SAAS,CAAA;AAAA,UACnF,CAAA,CAAA,MAAQ;AAAA,UAER;AAAA,QACF;AAGA,QAAA,IAAI;AACF,UAAA,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,cAAc,CAAA,YAAA,CAAA,EAAgB;AAAA,YAChD,MAAA,EAAQ,MAAA;AAAA,YACR,OAAA,EAAS,KAAK,gBAAA,EAAiB;AAAA,YAC/B,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,OAAA,EAAS,QAAQ,IAAA,EAAM,CAAC,MAAM,CAAA,EAAG;AAAA,WACzD,CAAA;AAAA,QACH,CAAA,CAAA,MAAQ;AAAA,QAER;AAEA,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,UAAA,CAAW,UAAA,KAAe,OAAA,IAAW,UAAA,CAAW,eAAe,UAAA,EAAY;AAC7E,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,+BAAA,EAAkC,UAAA,CAAW,UAAU,CAAA,CAAE,CAAA;AAAA,MACxF;AAEA,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAA,OAAA,KAAW,UAAA,CAAW,OAAA,EAAS,cAAc,CAAC,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,4BAAA,EAA+B,SAAS,CAAA,EAAA,CAAI,CAAA;AAAA,EAC3E;AAAA,EAEA,MAAM,IAAA,GAAsB;AAK1B,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AAAA,EACxB;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,IAAI,KAAK,aAAA,EAAe;AACtB,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,MAAM,IAAA,CAAK,aAAa,CAAA,iBAAA,EAAoB,IAAA,CAAK,aAAa,CAAA,CAAA,EAAI;AAAA,UAC7E,MAAA,EAAQ;AAAA,SACT,CAAA;AACD,QAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AAIZ,UAAA,IAAI,IAAA,CAAK,WAAW,GAAA,EAAK;AACvB,YAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,iCAAA,CAAmC,CAAA;AAAA,UACpE,CAAA,MAAO;AACL,YAAA,IAAA,CAAK,OAAO,IAAA,CAAK,CAAA,EAAG,UAAU,CAAA,8BAAA,EAAiC,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,UAC9E;AAAA,QACF;AAAA,MACF,SAAS,KAAA,EAAO;AAEd,QAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,UAAU,+BAA+B,KAAK,CAAA;AAAA,MACpE;AACA,MAAA,IAAA,CAAK,aAAA,GAAgB,IAAA;AAAA,IACvB;AACA,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,IAAA,IAAA,CAAK,iBAAA,GAAoB,IAAA;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,cAAA,CAAe,OAAA,EAAiB,IAAA,EAAiB,OAAA,EAAyD;AAC9G,IAAA,MAAM,KAAK,aAAA,EAAc;AAEzB,IAAA,IAAI,CAAC,KAAK,cAAA,EAAgB;AACxB,MAAA,MAAM,IAAI,oBAAA,CAAqB,IAAA,CAAK,EAAE,CAAA;AAAA,IACxC;AAEA,IAAA,MAAM,cAAc,IAAA,EAAM,MAAA,GAAS,CAAA,EAAG,OAAO,IAAI,IAAA,CAAK,GAAA,CAAI,CAAA,CAAA,KAAK,UAAA,CAAW,CAAC,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,GAAK,OAAA;AAC5F,IAAA,IAAA,CAAK,OAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,YAAA,EAAe,WAAW,CAAA,CAAE,CAAA;AAE3D,IAAA,MAAM,IAAA,GAAO;AAAA,MACX,OAAA;AAAA,MACA,IAAA,EAAM,QAAQ,EAAC;AAAA,MACf,GAAA,EAAK,OAAA,EAAS,GAAA,IAAO,EAAC;AAAA,MACtB,GAAA,EAAK,SAAS,GAAA,IAAO,MAAA;AAAA,MACrB,OAAA,EAAS,OAAA,EAAS,OAAA,IAAW,IAAA,CAAK;AAAA,KACpC;AAEA,IAAA,MAAM,UAAA,GAAa,CAAA;AACnB,IAAA,IAAI,SAAA,GAA0B,IAAA;AAE9B,IAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,UAAA,EAAY,OAAA,EAAA,EAAW;AACtD,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,cAAc,CAAA,YAAA,CAAA,EAAgB;AAAA,UAC7D,MAAA,EAAQ,MAAA;AAAA,UACR,OAAA,EAAS,KAAK,gBAAA,EAAiB;AAAA,UAC/B,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAAA,UACzB,QAAQ,OAAA,EAAS;AAAA,SAClB,CAAA;AAGD,QAAA,IAAA,CAAK,IAAA,CAAK,MAAA,KAAW,GAAA,IAAO,IAAA,CAAK,MAAA,KAAW,OAAO,IAAA,CAAK,MAAA,KAAW,GAAA,KAAQ,OAAA,GAAU,UAAA,EAAY;AAC/F,UAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,kBAAA,EAAqB,IAAA,CAAK,MAAM,CAAA,UAAA,EAAa,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,UAAU,CAAA,CAAE,CAAA;AACvG,UAAA,MAAM,IAAI,QAAQ,CAAA,OAAA,KAAW,UAAA,CAAW,SAAS,GAAA,IAAQ,OAAA,GAAU,EAAE,CAAC,CAAA;AACtE,UAAA;AAAA,QACF;AAGA,QAAA,IAAI,IAAA,CAAK,WAAW,GAAA,EAAK;AACvB,UAAA,OAAO;AAAA,YACL,OAAA,EAAS,WAAA;AAAA,YACT,IAAA;AAAA,YACA,OAAA,EAAS,KAAA;AAAA,YACT,QAAA,EAAU,GAAA;AAAA,YACV,MAAA,EAAQ,EAAA;AAAA,YACR,MAAA,EAAQ,oDAAA;AAAA,YACR,eAAA,EAAiB,OAAA,EAAS,OAAA,IAAW,IAAA,CAAK,eAAA;AAAA,YAC1C,QAAA,EAAU;AAAA,WACZ;AAAA,QACF;AAEA,QAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACZ,UAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,IAAA,EAAK;AAClC,UAAA,MAAM,IAAI,MAAM,CAAA,EAAG,UAAU,oBAAoB,IAAA,CAAK,MAAM,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AAAA,QAC7E;AAEA,QAAA,MAAM,MAAA,GAAU,MAAM,IAAA,CAAK,IAAA,EAAK;AAUhC,QAAA,IAAI,OAAA,EAAS,QAAA,IAAY,MAAA,CAAO,MAAA,EAAQ;AACtC,UAAA,OAAA,CAAQ,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,QAChC;AACA,QAAA,IAAI,OAAA,EAAS,QAAA,IAAY,MAAA,CAAO,MAAA,EAAQ;AACtC,UAAA,OAAA,CAAQ,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,QAChC;AAEA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS,WAAA;AAAA,UACT,IAAA;AAAA,UACA,SAAS,MAAA,CAAO,OAAA;AAAA,UAChB,UAAU,MAAA,CAAO,QAAA;AAAA,UACjB,QAAQ,MAAA,CAAO,MAAA;AAAA,UACf,QAAQ,MAAA,CAAO,MAAA;AAAA,UACf,iBAAiB,MAAA,CAAO,eAAA;AAAA,UACxB,UAAU,MAAA,CAAO;AAAA,SACnB;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,KAAA,YAAiB,YAAA,IAAgB,KAAA,CAAM,IAAA,KAAS,YAAA,EAAc;AAChE,UAAA,MAAM,KAAA;AAAA,QACR;AACA,QAAA,SAAA,GAAY,KAAA;AACZ,QAAA,IAAI,UAAU,UAAA,EAAY;AACxB,UAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,wBAAA,EAA2B,UAAU,CAAC,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA,CAAA,EAAK,KAAK,CAAA;AAC7F,UAAA,MAAM,IAAI,QAAQ,CAAA,OAAA,KAAW,UAAA,CAAW,SAAS,GAAA,IAAQ,OAAA,GAAU,EAAE,CAAC,CAAA;AACtE,UAAA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,IAAa,IAAI,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,oCAAA,CAAsC,CAAA;AAAA,EAClF;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB,IAAA,EAAoD;AAClE,IAAA,IAAI,IAAA,CAAK,qBAAA,KAA0B,MAAA,EAAW,OAAO,KAAK,uBAAA,EAAwB;AAClF,IAAA,IAAI,OAAO,IAAA,CAAK,qBAAA,KAA0B,QAAA,SAAiB,IAAA,CAAK,qBAAA;AAChE,IAAA,MAAM,mBAAA,GAAsB,KAAK,uBAAA,EAAwB;AACzD,IAAA,OAAO,KAAK,qBAAA,CAAsB,EAAE,qBAAqB,cAAA,EAAgB,IAAA,EAAM,gBAAgB,CAAA;AAAA,EACjG;AAAA,EAEQ,uBAAA,GAAkC;AACxC,IAAA,OAAO;AAAA,MACL,4BAAA;AAAA,MACA,cAAA;AAAA,MACA,4DAAA;AAAA,MACA,4CAAA;AAAA,MACA,4CAAA;AAAA,MACA,CAAA,0BAAA,EAA6B,KAAK,YAAY,CAAA,SAAA,CAAA;AAAA,MAC9C,mEAAA;AAAA,MACA;AAAA,KACF,CAAE,KAAK,IAAI,CAAA;AAAA,EACb;AAAA,EAEA,MAAM,OAAA,GAAgC;AACpC,IAAA,OAAO;AAAA,MACL,IAAI,IAAA,CAAK,EAAA;AAAA,MACT,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,SAAA,EAAW,IAAA,CAAK,UAAA,oBAAc,IAAI,IAAA,EAAK;AAAA,MACvC,QAAA,EAAU;AAAA,QACR,cAAc,IAAA,CAAK,aAAA;AAAA,QACnB,eAAe,IAAA,CAAK,cAAA;AAAA,QACpB,SAAS,IAAA,CAAK,QAAA;AAAA,QACd,aAAa,IAAA,CAAK,YAAA;AAAA,QAClB,QAAQ,IAAA,CAAK;AAAA;AACf,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,yBAAyB,SAAA,EAA2C;AAEhF,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,YAAA,CAAa,CAAA,aAAA,EAAgB,SAAS,CAAA,CAAE,CAAA;AACpE,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,MAAM,OAAA,GAAW,MAAM,QAAA,CAAS,IAAA,EAAK;AAGrC,MAAA,MAAM,QAAA,GAAW,QAAQ,gBAAA,GAAmB,MAAA,CAAO,KAAK,OAAA,CAAQ,gBAAgB,CAAA,CAAE,CAAC,CAAA,GAAI,MAAA;AACvF,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,uCAAA,CAAyC,CAAA;AACxE,QAAA,OAAO,QAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,oCAAA,CAAsC,CAAA;AACrE,IAAA,MAAM,aAAa,MAAM,IAAA,CAAK,YAAA,CAAa,CAAA,aAAA,EAAgB,SAAS,CAAA,kBAAA,CAAA,EAAsB;AAAA,MACxF,MAAA,EAAQ,OAAA;AAAA,MACR,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE;AAAA,KACxB,CAAA;AACD,IAAA,IAAI,WAAW,EAAA,EAAI;AACjB,MAAA,MAAM,MAAA,GAAU,MAAM,UAAA,CAAW,IAAA,EAAK;AAGtC,MAAA,MAAM,OAAA,GAAU,OAAO,gBAAA,GAAmB,MAAA,CAAO,KAAK,MAAA,CAAO,gBAAgB,CAAA,CAAE,CAAC,CAAA,GAAI,MAAA;AACpF,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,gCAAA,CAAkC,CAAA;AACjE,QAAA,OAAO,OAAA;AAAA,MACT;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,uEAAA,CAAyE,CAAA;AACxG,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEQ,gBAAA,GAA2C;AACjD,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,cAAA,EAAgB,kBAAA;AAAA,MAChB,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,OAAO,CAAA;AAAA,KACvC;AACA,IAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,MAAA,OAAA,CAAQ,4BAA4B,IAAI,IAAA,CAAK,iBAAA;AAAA,IAC/C;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAc,YAAA,CAAa,IAAA,EAAc,OAAA,GAAuB,EAAC,EAAsB;AACrF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,EAAM,eAAe,CAAA;AACzC,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,IAAA,CAAK,OAAO,CAAA;AAAA,IAC7C;AAEA,IAAA,OAAO,KAAA,CAAM,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,MAC3B,GAAG,OAAA;AAAA,MACH,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAAA;AAAA,QACpC,GAAK,OAAA,CAAQ,OAAA,IAAsC;AAAC;AACtD,KACD,CAAA;AAAA,EACH;AACF;;;ACrcO,IAAM,qBAAA,GAA+D;AAAA,EAC1E,EAAA,EAAI,QAAA;AAAA,EACJ,IAAA,EAAM,gBAAA;AAAA,EACN,WAAA,EAAa,gDAAA;AAAA,EACb,YAAA,EAAc;AAAA,IACZ,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,kBAAA,EAAmB;AAAA,MACzD,MAAA,EAAQ,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,gBAAA,EAAiB;AAAA,MACxD,WAAA,EAAa,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,8BAAA,EAA+B;AAAA,MAC3E,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,OAAA;AAAA,QACN,WAAA,EAAa,oBAAA;AAAA,QACb,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,QACxB,OAAA,EAAS,CAAC,MAAM;AAAA,OAClB;AAAA,MACA,aAAa,EAAE,IAAA,EAAM,UAAU,WAAA,EAAa,kCAAA,EAAoC,SAAS,EAAA,EAAG;AAAA,MAC5F,QAAQ,EAAE,IAAA,EAAM,UAAU,WAAA,EAAa,uBAAA,EAAyB,SAAS,IAAA,EAAK;AAAA,MAC9E,GAAA,EAAK;AAAA,QACH,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa,uBAAA;AAAA,QACb,oBAAA,EAAsB,EAAE,IAAA,EAAM,QAAA;AAAS,OACzC;AAAA,MACA,gBAAgB,EAAE,IAAA,EAAM,UAAU,WAAA,EAAa,8BAAA,EAAgC,SAAS,IAAA;AAAM;AAChG,GACF;AAAA,EACA,aAAA,EAAe,CAAA,MAAA,KAAU,IAAI,aAAA,CAAc,MAAM;AACnD","file":"index.js","sourcesContent":["/**\n * Executor function source code deployed to Vercel as a serverless function.\n *\n * Returns a string because it's sent as inline file content via\n * the Vercel Deployments API — no separate build step needed.\n *\n * The secret and user env vars are embedded as constants in the source\n * because the Vercel Deployments API does not support setting env vars\n * directly — they must be configured via vercel.json or project settings.\n */\nexport function getExecutorSource(secret: string, env: Record<string, string>): string {\n  const envEntries = Object.entries(env)\n    .map(([k, v]) => `  ${JSON.stringify(k)}: ${JSON.stringify(v)}`)\n    .join(',\\n');\n\n  return `\nconst { execFileSync } = require('child_process');\n\nconst SANDBOX_SECRET = ${JSON.stringify(secret)};\nconst SANDBOX_ENV = {\n${envEntries}\n};\n\nmodule.exports = async (req, res) => {\n  // Auth check\n  const authHeader = req.headers['authorization'] || '';\n  if (!SANDBOX_SECRET || authHeader !== 'Bearer ' + SANDBOX_SECRET) {\n    return res.status(401).json({ error: 'Unauthorized' });\n  }\n\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' });\n  }\n\n  const { command, args = [], env = {}, cwd, timeout = 55000 } = req.body || {};\n\n  if (!command) {\n    return res.status(400).json({ error: 'Missing required field: command' });\n  }\n\n  const execCwd = cwd || '/tmp';\n  const execEnv = { ...process.env, ...SANDBOX_ENV, ...env };\n\n  // When args is empty the caller sent a full shell command string\n  // (e.g. \"echo hello\" or \"ls -la | grep foo\").  Run it through\n  // /bin/sh so builtins and pipes work.  When args is non-empty the\n  // caller split the command properly — use execFileSync to avoid\n  // shell injection.\n  const useShell = !args || args.length === 0;\n  const execCommand = useShell ? '/bin/sh' : command;\n  const execArgs = useShell ? ['-c', command] : args;\n\n  const startTime = Date.now();\n  let timedOut = false;\n\n  try {\n    const stdout = execFileSync(execCommand, execArgs, {\n      cwd: execCwd,\n      env: execEnv,\n      timeout,\n      maxBuffer: 10 * 1024 * 1024,\n      encoding: 'utf-8',\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n\n    return res.status(200).json({\n      success: true,\n      exitCode: 0,\n      stdout: stdout || '',\n      stderr: '',\n      executionTimeMs: Date.now() - startTime,\n      timedOut: false,\n    });\n  } catch (error) {\n    timedOut = error.killed || false;\n\n    return res.status(200).json({\n      success: false,\n      exitCode: error.status != null ? error.status : 1,\n      stdout: error.stdout || '',\n      stderr: error.stderr || '',\n      executionTimeMs: Date.now() - startTime,\n      timedOut,\n    });\n  }\n};\n`;\n}\n","/**\n * Vercel Sandbox Provider\n *\n * Deploys code as Vercel serverless functions and executes commands\n * via HTTP invocation. Stateless — no persistent filesystem, no\n * interactive shell, no long-running processes.\n *\n * @see https://vercel.com/docs/rest-api\n */\n\nimport type { RequestContext } from '@mastra/core/di';\nimport type {\n  SandboxInfo,\n  CommandResult,\n  ExecuteCommandOptions,\n  MastraSandboxOptions,\n  ProviderStatus,\n  InstructionsOption,\n} from '@mastra/core/workspace';\nimport { MastraSandbox, SandboxNotReadyError } from '@mastra/core/workspace';\nimport { getExecutorSource } from '../executor';\n\nconst LOG_PREFIX = '[VercelSandbox]';\n\nconst VERCEL_API_BASE = 'https://api.vercel.com';\n\n/**\n * Shell-quote an argument for safe interpolation into a shell command string.\n * Mirrors the implementation in packages/core/src/workspace/sandbox/utils.ts\n * which is not publicly exported.\n */\nfunction shellQuote(arg: string): string {\n  if (/^[a-zA-Z0-9._\\-\\/=:@]+$/.test(arg)) return arg;\n  return `'${arg.replace(/'/g, \"'\\\\''\")}'`;\n}\n\n// =============================================================================\n// Options\n// =============================================================================\n\nexport interface VercelSandboxOptions extends Omit<MastraSandboxOptions, 'processes'> {\n  /** Vercel API token. Falls back to VERCEL_TOKEN env var. */\n  token?: string;\n  /** Vercel team ID for team-scoped deployments. */\n  teamId?: string;\n  /** Existing Vercel project name. Auto-generated if omitted. */\n  projectName?: string;\n  /** Deployment regions. @default ['iad1'] */\n  regions?: string[];\n  /** Function max duration in seconds. @default 60 */\n  maxDuration?: number;\n  /** Function memory in MB. @default 1024 */\n  memory?: number;\n  /** Environment variables baked into the deployed function. */\n  env?: Record<string, string>;\n  /** Per-invocation command timeout in ms. @default 55000 */\n  commandTimeout?: number;\n  /**\n   * Custom instructions that override the default instructions\n   * returned by `getInstructions()`.\n   */\n  instructions?: InstructionsOption;\n}\n\n// =============================================================================\n// Implementation\n// =============================================================================\n\nexport class VercelSandbox extends MastraSandbox {\n  readonly id: string;\n  readonly name = 'VercelSandbox';\n  readonly provider = 'vercel';\n  status: ProviderStatus = 'pending';\n\n  private readonly _token: string;\n  private readonly _teamId?: string;\n  private readonly _projectName?: string;\n  private readonly _regions: string[];\n  private readonly _maxDuration: number;\n  private readonly _memory: number;\n  private readonly _env: Record<string, string>;\n  private readonly _commandTimeout: number;\n  private readonly _instructionsOverride?: InstructionsOption;\n  private readonly _secret: string;\n\n  private _deploymentUrl: string | null = null;\n  private _deploymentId: string | null = null;\n  private _protectionBypass: string | null = null;\n  private _createdAt: Date | null = null;\n\n  constructor(options: VercelSandboxOptions = {}) {\n    super({ name: 'VercelSandbox' });\n\n    this.id = `vercel-sandbox-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;\n    this._token = options.token || process.env.VERCEL_TOKEN || '';\n    this._teamId = options.teamId;\n    this._projectName = options.projectName;\n    this._regions = options.regions ?? ['iad1'];\n    this._maxDuration = options.maxDuration ?? 60;\n    this._memory = options.memory ?? 1024;\n    this._env = options.env ?? {};\n    this._commandTimeout = options.commandTimeout ?? 55_000;\n    this._instructionsOverride = options.instructions;\n    this._secret = crypto.randomUUID();\n  }\n\n  // ---------------------------------------------------------------------------\n  // Lifecycle\n  // ---------------------------------------------------------------------------\n\n  async start(): Promise<void> {\n    if (this._deploymentUrl) {\n      return;\n    }\n\n    if (!this._token) {\n      throw new Error(`${LOG_PREFIX} Missing Vercel API token. Set VERCEL_TOKEN env var or pass token option.`);\n    }\n\n    // Clean up any stale deployment from a previous stop() → start() cycle.\n    // Without this, the old _deploymentId is overwritten and that deployment leaks.\n    if (this._deploymentId) {\n      this.logger.debug(`${LOG_PREFIX} Cleaning up stale deployment ${this._deploymentId} before restarting...`);\n      try {\n        const resp = await this._vercelFetch(`/v13/deployments/${this._deploymentId}`, { method: 'DELETE' });\n        if (!resp.ok && resp.status !== 404) {\n          this.logger.warn(`${LOG_PREFIX} Failed to delete stale deployment: ${resp.status}`);\n        }\n      } catch (error) {\n        this.logger.warn(`${LOG_PREFIX} Error deleting stale deployment:`, error);\n      }\n      this._deploymentId = null;\n    }\n\n    this.logger.debug(`${LOG_PREFIX} Deploying executor function...`);\n\n    const vercelJson = JSON.stringify({\n      functions: {\n        'api/execute.js': {\n          memory: this._memory,\n          maxDuration: this._maxDuration,\n        },\n      },\n      regions: this._regions,\n    });\n\n    // Create the deployment\n    const deploymentBody: Record<string, unknown> = {\n      name: this._projectName ?? `mastra-sandbox-${this.id}`,\n      files: [\n        {\n          file: 'api/execute.js',\n          data: getExecutorSource(this._secret, this._env),\n        },\n        {\n          file: 'vercel.json',\n          data: vercelJson,\n        },\n      ],\n      projectSettings: {\n        framework: null,\n      },\n      target: 'production',\n    };\n\n    const createResp = await this._vercelFetch('/v13/deployments', {\n      method: 'POST',\n      body: JSON.stringify(deploymentBody),\n    });\n\n    if (!createResp.ok) {\n      const errorBody = await createResp.text();\n      throw new Error(`${LOG_PREFIX} Failed to create deployment: ${createResp.status} ${errorBody}`);\n    }\n\n    const deployment = (await createResp.json()) as { id: string; url: string; readyState: string; projectId?: string };\n    this._deploymentId = deployment.id;\n\n    this.logger.debug(`${LOG_PREFIX} Deployment created: ${deployment.id}, polling for READY...`);\n\n    // Poll until ready\n    const maxWaitMs = 120_000;\n    const pollIntervalMs = 3_000;\n    const deadline = Date.now() + maxWaitMs;\n\n    while (Date.now() < deadline) {\n      const statusResp = await this._vercelFetch(`/v13/deployments/${deployment.id}`);\n      if (!statusResp.ok) {\n        throw new Error(`${LOG_PREFIX} Failed to check deployment status: ${statusResp.status}`);\n      }\n\n      const statusBody = (await statusResp.json()) as { readyState: string; url: string };\n\n      if (statusBody.readyState === 'READY') {\n        this._deploymentUrl = `https://${statusBody.url}`;\n        this._createdAt = new Date();\n        this.logger.debug(`${LOG_PREFIX} Deployment ready: ${this._deploymentUrl}`);\n\n        // Acquire a deployment protection bypass token.\n        // Pro/Enterprise teams have Deployment Protection enabled by default,\n        // which intercepts HTTP requests with an SSO login page before they\n        // reach the serverless function. The bypass token lets us skip that.\n        if (deployment.projectId) {\n          try {\n            this._protectionBypass = await this._acquireProtectionBypass(deployment.projectId);\n          } catch {\n            // Non-fatal — if the project has no deployment protection, this is unnecessary.\n          }\n        }\n\n        // Warm-up ping\n        try {\n          await fetch(`${this._deploymentUrl}/api/execute`, {\n            method: 'POST',\n            headers: this._executorHeaders(),\n            body: JSON.stringify({ command: 'echo', args: ['warm'] }),\n          });\n        } catch {\n          // Warm-up failure is non-fatal\n        }\n\n        return;\n      }\n\n      if (statusBody.readyState === 'ERROR' || statusBody.readyState === 'CANCELED') {\n        throw new Error(`${LOG_PREFIX} Deployment failed with state: ${statusBody.readyState}`);\n      }\n\n      await new Promise(resolve => setTimeout(resolve, pollIntervalMs));\n    }\n\n    throw new Error(`${LOG_PREFIX} Deployment timed out after ${maxWaitMs}ms`);\n  }\n\n  async stop(): Promise<void> {\n    // Only clear the URL (disconnects from the deployment) but keep\n    // _deploymentId so a subsequent destroy() can still clean up the\n    // cloud resource. Clearing both would make destroy() a no-op and\n    // leak the deployment.\n    this._deploymentUrl = null;\n  }\n\n  async destroy(): Promise<void> {\n    if (this._deploymentId) {\n      try {\n        const resp = await this._vercelFetch(`/v13/deployments/${this._deploymentId}`, {\n          method: 'DELETE',\n        });\n        if (!resp.ok) {\n          // 404 means the deployment is already gone — that's fine.\n          // Other status codes indicate infrastructure issues (auth, network)\n          // and should be surfaced more visibly.\n          if (resp.status === 404) {\n            this.logger.debug(`${LOG_PREFIX} Deployment already deleted (404)`);\n          } else {\n            this.logger.warn(`${LOG_PREFIX} Failed to delete deployment: ${resp.status}`);\n          }\n        }\n      } catch (error) {\n        // Network-level failure — warn rather than debug so it's visible\n        this.logger.warn(`${LOG_PREFIX} Error deleting deployment:`, error);\n      }\n      this._deploymentId = null;\n    }\n    this._deploymentUrl = null;\n    this._protectionBypass = null;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Command Execution\n  // ---------------------------------------------------------------------------\n\n  async executeCommand(command: string, args?: string[], options?: ExecuteCommandOptions): Promise<CommandResult> {\n    await this.ensureRunning();\n\n    if (!this._deploymentUrl) {\n      throw new SandboxNotReadyError(this.id);\n    }\n\n    const fullCommand = args?.length ? `${command} ${args.map(a => shellQuote(a)).join(' ')}` : command;\n    this.logger.debug(`${LOG_PREFIX} Executing: ${fullCommand}`);\n\n    const body = {\n      command,\n      args: args ?? [],\n      env: options?.env ?? {},\n      cwd: options?.cwd ?? '/tmp',\n      timeout: options?.timeout ?? this._commandTimeout,\n    };\n\n    const maxRetries = 2;\n    let lastError: Error | null = null;\n\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\n      try {\n        const resp = await fetch(`${this._deploymentUrl}/api/execute`, {\n          method: 'POST',\n          headers: this._executorHeaders(),\n          body: JSON.stringify(body),\n          signal: options?.abortSignal,\n        });\n\n        // Retry on transient errors\n        if ((resp.status === 429 || resp.status === 502 || resp.status === 503) && attempt < maxRetries) {\n          this.logger.debug(`${LOG_PREFIX} Retryable status ${resp.status}, attempt ${attempt + 1}/${maxRetries}`);\n          await new Promise(resolve => setTimeout(resolve, 1000 * (attempt + 1)));\n          continue;\n        }\n\n        // Gateway timeout → timedOut\n        if (resp.status === 504) {\n          return {\n            command: fullCommand,\n            args,\n            success: false,\n            exitCode: 124,\n            stdout: '',\n            stderr: 'Function execution timed out (504 Gateway Timeout)',\n            executionTimeMs: options?.timeout ?? this._commandTimeout,\n            timedOut: true,\n          };\n        }\n\n        if (!resp.ok) {\n          const errorText = await resp.text();\n          throw new Error(`${LOG_PREFIX} Execute failed: ${resp.status} ${errorText}`);\n        }\n\n        const result = (await resp.json()) as {\n          success: boolean;\n          exitCode: number;\n          stdout: string;\n          stderr: string;\n          executionTimeMs: number;\n          timedOut: boolean;\n        };\n\n        // Stream callbacks\n        if (options?.onStdout && result.stdout) {\n          options.onStdout(result.stdout);\n        }\n        if (options?.onStderr && result.stderr) {\n          options.onStderr(result.stderr);\n        }\n\n        return {\n          command: fullCommand,\n          args,\n          success: result.success,\n          exitCode: result.exitCode,\n          stdout: result.stdout,\n          stderr: result.stderr,\n          executionTimeMs: result.executionTimeMs,\n          timedOut: result.timedOut,\n        };\n      } catch (error) {\n        if (error instanceof DOMException && error.name === 'AbortError') {\n          throw error;\n        }\n        lastError = error as Error;\n        if (attempt < maxRetries) {\n          this.logger.debug(`${LOG_PREFIX} Request error, attempt ${attempt + 1}/${maxRetries}:`, error);\n          await new Promise(resolve => setTimeout(resolve, 1000 * (attempt + 1)));\n          continue;\n        }\n      }\n    }\n\n    throw lastError ?? new Error(`${LOG_PREFIX} executeCommand failed after retries`);\n  }\n\n  // ---------------------------------------------------------------------------\n  // Info & Instructions\n  // ---------------------------------------------------------------------------\n\n  // Matches the resolveInstructions pattern in packages/core/src/workspace/utils.ts\n  getInstructions(opts?: { requestContext?: RequestContext }): string {\n    if (this._instructionsOverride === undefined) return this._getDefaultInstructions();\n    if (typeof this._instructionsOverride === 'string') return this._instructionsOverride;\n    const defaultInstructions = this._getDefaultInstructions();\n    return this._instructionsOverride({ defaultInstructions, requestContext: opts?.requestContext });\n  }\n\n  private _getDefaultInstructions(): string {\n    return [\n      'Vercel serverless sandbox.',\n      'Limitations:',\n      '- Stateless: no persistent filesystem between invocations.',\n      '- No interactive shell or streaming stdin.',\n      '- No long-running or background processes.',\n      `- Maximum execution time: ${this._maxDuration} seconds.`,\n      '- Only /tmp is writable (ephemeral, cleared between invocations).',\n      '- Shell commands (pipes, builtins) are supported via /bin/sh -c.',\n    ].join('\\n');\n  }\n\n  async getInfo(): Promise<SandboxInfo> {\n    return {\n      id: this.id,\n      name: this.name,\n      provider: this.provider,\n      status: this.status,\n      createdAt: this._createdAt ?? new Date(),\n      metadata: {\n        deploymentId: this._deploymentId,\n        deploymentUrl: this._deploymentUrl,\n        regions: this._regions,\n        maxDuration: this._maxDuration,\n        memory: this._memory,\n      },\n    };\n  }\n\n  // ---------------------------------------------------------------------------\n  // Private Helpers\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Fetch an existing protection bypass token for the project, or create one\n   * if none exists. Returns the token string, or null if acquisition fails.\n   */\n  private async _acquireProtectionBypass(projectId: string): Promise<string | null> {\n    // 1. Check if the project already has a bypass token.\n    const projResp = await this._vercelFetch(`/v9/projects/${projectId}`);\n    if (projResp.ok) {\n      const project = (await projResp.json()) as {\n        protectionBypass?: Record<string, unknown>;\n      };\n      const existing = project.protectionBypass ? Object.keys(project.protectionBypass)[0] : undefined;\n      if (existing) {\n        this.logger.debug(`${LOG_PREFIX} Using existing protection bypass token`);\n        return existing;\n      }\n    }\n\n    // 2. No token exists — create one via the dedicated endpoint.\n    this.logger.debug(`${LOG_PREFIX} Creating protection bypass token...`);\n    const createResp = await this._vercelFetch(`/v1/projects/${projectId}/protection-bypass`, {\n      method: 'PATCH',\n      body: JSON.stringify({}),\n    });\n    if (createResp.ok) {\n      const result = (await createResp.json()) as {\n        protectionBypass?: Record<string, unknown>;\n      };\n      const created = result.protectionBypass ? Object.keys(result.protectionBypass)[0] : undefined;\n      if (created) {\n        this.logger.debug(`${LOG_PREFIX} Protection bypass token created`);\n        return created;\n      }\n    }\n\n    this.logger.debug(`${LOG_PREFIX} Could not acquire protection bypass token (project may not require it)`);\n    return null;\n  }\n\n  private _executorHeaders(): Record<string, string> {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      Authorization: `Bearer ${this._secret}`,\n    };\n    if (this._protectionBypass) {\n      headers['x-vercel-protection-bypass'] = this._protectionBypass;\n    }\n    return headers;\n  }\n\n  private async _vercelFetch(path: string, options: RequestInit = {}): Promise<Response> {\n    const url = new URL(path, VERCEL_API_BASE);\n    if (this._teamId) {\n      url.searchParams.set('teamId', this._teamId);\n    }\n\n    return fetch(url.toString(), {\n      ...options,\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${this._token}`,\n        ...((options.headers as Record<string, string>) ?? {}),\n      },\n    });\n  }\n}\n","/**\n * Vercel sandbox provider descriptor for MastraEditor.\n *\n * @example\n * ```typescript\n * import { vercelSandboxProvider } from '@mastra/vercel';\n *\n * const editor = new MastraEditor({\n *   sandboxes: [vercelSandboxProvider],\n * });\n * ```\n */\nimport type { SandboxProvider } from '@mastra/core/editor';\nimport { VercelSandbox } from './sandbox';\n\n/**\n * Serializable subset of VercelSandboxOptions for editor storage.\n */\ninterface VercelProviderConfig {\n  token?: string;\n  teamId?: string;\n  projectName?: string;\n  regions?: string[];\n  maxDuration?: number;\n  memory?: number;\n  env?: Record<string, string>;\n  commandTimeout?: number;\n}\n\nexport const vercelSandboxProvider: SandboxProvider<VercelProviderConfig> = {\n  id: 'vercel',\n  name: 'Vercel Sandbox',\n  description: 'Serverless sandbox powered by Vercel Functions',\n  configSchema: {\n    type: 'object',\n    properties: {\n      token: { type: 'string', description: 'Vercel API token' },\n      teamId: { type: 'string', description: 'Vercel team ID' },\n      projectName: { type: 'string', description: 'Existing Vercel project name' },\n      regions: {\n        type: 'array',\n        description: 'Deployment regions',\n        items: { type: 'string' },\n        default: ['iad1'],\n      },\n      maxDuration: { type: 'number', description: 'Function max duration in seconds', default: 60 },\n      memory: { type: 'number', description: 'Function memory in MB', default: 1024 },\n      env: {\n        type: 'object',\n        description: 'Environment variables',\n        additionalProperties: { type: 'string' },\n      },\n      commandTimeout: { type: 'number', description: 'Per-invocation timeout in ms', default: 55000 },\n    },\n  },\n  createSandbox: config => new VercelSandbox(config),\n};\n"]}

package/dist/provider.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Vercel sandbox provider descriptor for MastraEditor.
+ *
+ * @example
+ * ```typescript
+ * import { vercelSandboxProvider } from '@mastra/vercel';
+ *
+ * const editor = new MastraEditor({
+ *   sandboxes: [vercelSandboxProvider],
+ * });
+ * ```
+ */
+import type { SandboxProvider } from '@mastra/core/editor';
+/**
+ * Serializable subset of VercelSandboxOptions for editor storage.
+ */
+interface VercelProviderConfig {
+    token?: string;
+    teamId?: string;
+    projectName?: string;
+    regions?: string[];
+    maxDuration?: number;
+    memory?: number;
+    env?: Record<string, string>;
+    commandTimeout?: number;
+}
+export declare const vercelSandboxProvider: SandboxProvider<VercelProviderConfig>;
+export {};
+//# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAG3D;;GAEG;AACH,UAAU,oBAAoB;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,eAAO,MAAM,qBAAqB,EAAE,eAAe,CAAC,oBAAoB,CA2BvE,CAAC"}

package/dist/sandbox/index.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Vercel Sandbox Provider
+ *
+ * Deploys code as Vercel serverless functions and executes commands
+ * via HTTP invocation. Stateless — no persistent filesystem, no
+ * interactive shell, no long-running processes.
+ *
+ * @see https://vercel.com/docs/rest-api
+ */
+import type { RequestContext } from '@mastra/core/di';
+import type { SandboxInfo, CommandResult, ExecuteCommandOptions, MastraSandboxOptions, ProviderStatus, InstructionsOption } from '@mastra/core/workspace';
+import { MastraSandbox } from '@mastra/core/workspace';
+export interface VercelSandboxOptions extends Omit<MastraSandboxOptions, 'processes'> {
+    /** Vercel API token. Falls back to VERCEL_TOKEN env var. */
+    token?: string;
+    /** Vercel team ID for team-scoped deployments. */
+    teamId?: string;
+    /** Existing Vercel project name. Auto-generated if omitted. */
+    projectName?: string;
+    /** Deployment regions. @default ['iad1'] */
+    regions?: string[];
+    /** Function max duration in seconds. @default 60 */
+    maxDuration?: number;
+    /** Function memory in MB. @default 1024 */
+    memory?: number;
+    /** Environment variables baked into the deployed function. */
+    env?: Record<string, string>;
+    /** Per-invocation command timeout in ms. @default 55000 */
+    commandTimeout?: number;
+    /**
+     * Custom instructions that override the default instructions
+     * returned by `getInstructions()`.
+     */
+    instructions?: InstructionsOption;
+}
+export declare class VercelSandbox extends MastraSandbox {
+    readonly id: string;
+    readonly name = "VercelSandbox";
+    readonly provider = "vercel";
+    status: ProviderStatus;
+    private readonly _token;
+    private readonly _teamId?;
+    private readonly _projectName?;
+    private readonly _regions;
+    private readonly _maxDuration;
+    private readonly _memory;
+    private readonly _env;
+    private readonly _commandTimeout;
+    private readonly _instructionsOverride?;
+    private readonly _secret;
+    private _deploymentUrl;
+    private _deploymentId;
+    private _protectionBypass;
+    private _createdAt;
+    constructor(options?: VercelSandboxOptions);
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    destroy(): Promise<void>;
+    executeCommand(command: string, args?: string[], options?: ExecuteCommandOptions): Promise<CommandResult>;
+    getInstructions(opts?: {
+        requestContext?: RequestContext;
+    }): string;
+    private _getDefaultInstructions;
+    getInfo(): Promise<SandboxInfo>;
+    /**
+     * Fetch an existing protection bypass token for the project, or create one
+     * if none exists. Returns the token string, or null if acquisition fails.
+     */
+    private _acquireProtectionBypass;
+    private _executorHeaders;
+    private _vercelFetch;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/sandbox/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,kBAAkB,EACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAwB,MAAM,wBAAwB,CAAC;AAqB7E,MAAM,WAAW,oBAAqB,SAAQ,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IACnF,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAMD,qBAAa,aAAc,SAAQ,aAAa;IAC9C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,QAAQ,YAAY;IAC7B,MAAM,EAAE,cAAc,CAAa;IAEnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAC9C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAqB;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,iBAAiB,CAAuB;IAChD,OAAO,CAAC,UAAU,CAAqB;gBAE3B,OAAO,GAAE,oBAAyB;IAoBxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA4HtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQrB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA8BxB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC;IAwG/G,eAAe,CAAC,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,cAAc,CAAA;KAAE,GAAG,MAAM;IAOnE,OAAO,CAAC,uBAAuB;IAazB,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC;IAqBrC;;;OAGG;YACW,wBAAwB;IAmCtC,OAAO,CAAC,gBAAgB;YAWV,YAAY;CAe3B"}

package/package.json

@@ -0,0 +1,65 @@
+{
+  "name": "@mastra/vercel",
+  "version": "0.0.0",
+  "description": "Vercel serverless sandbox provider for Mastra workspaces",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "build": "tsup --silent --config tsup.config.ts",
+    "build:lib": "pnpm build",
+    "build:watch": "pnpm build --watch",
+    "test:unit": "vitest run --exclude '**/*.integration.test.ts'",
+    "test:watch": "vitest watch",
+    "test": "vitest run ./src/**/*.integration.test.ts",
+    "test:cloud": "pnpm test",
+    "lint": "eslint ."
+  },
+  "license": "Apache-2.0",
+  "dependencies": {},
+  "devDependencies": {
+    "@internal/lint": "workspace:*",
+    "@internal/types-builder": "workspace:*",
+    "@mastra/core": "workspace:*",
+    "@types/node": "22.19.15",
+    "@vitest/coverage-v8": "catalog:",
+    "@vitest/ui": "catalog:",
+    "dotenv": "^17.3.1",
+    "eslint": "^9.39.4",
+    "tsup": "^8.5.1",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
+  },
+  "peerDependencies": {
+    "@mastra/core": ">=1.12.0-0 <2.0.0-0"
+  },
+  "files": [
+    "dist",
+    "CHANGELOG.md"
+  ],
+  "homepage": "https://mastra.ai",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mastra-ai/mastra.git",
+    "directory": "workspaces/vercel"
+  },
+  "bugs": {
+    "url": "https://github.com/mastra-ai/mastra/issues"
+  },
+  "engines": {
+    "node": ">=22.13.0"
+  }
+}