@mastra/vercel 1.0.0 → 1.0.2

package/dist/index.cjs

@@ -0,0 +1,837 @@
+'use strict';
+
+var workspace = require('@mastra/core/workspace');
+var sandbox = require('@vercel/sandbox');
+
+// src/sandbox/index.ts
+
+// src/executor/index.ts
+function getExecutorSource(secret, env) {
+  const envEntries = Object.entries(env).map(([k, v]) => `  ${JSON.stringify(k)}: ${JSON.stringify(v)}`).join(",\n");
+  return `
+const { execFileSync } = require('child_process');
+
+const SANDBOX_SECRET = ${JSON.stringify(secret)};
+const SANDBOX_ENV = {
+${envEntries}
+};
+
+module.exports = async (req, res) => {
+  // Auth check
+  const authHeader = req.headers['authorization'] || '';
+  if (!SANDBOX_SECRET || authHeader !== 'Bearer ' + SANDBOX_SECRET) {
+    return res.status(401).json({ error: 'Unauthorized' });
+  }
+
+  if (req.method !== 'POST') {
+    return res.status(405).json({ error: 'Method not allowed' });
+  }
+
+  const { command, args = [], env = {}, cwd, timeout = 55000 } = req.body || {};
+
+  if (!command) {
+    return res.status(400).json({ error: 'Missing required field: command' });
+  }
+
+  const execCwd = cwd || '/tmp';
+  const execEnv = { ...process.env, ...SANDBOX_ENV, ...env };
+
+  // When args is empty the caller sent a full shell command string
+  // (e.g. "echo hello" or "ls -la | grep foo").  Run it through
+  // /bin/sh so builtins and pipes work.  When args is non-empty the
+  // caller split the command properly \u2014 use execFileSync to avoid
+  // shell injection.
+  const useShell = !args || args.length === 0;
+  const execCommand = useShell ? '/bin/sh' : command;
+  const execArgs = useShell ? ['-c', command] : args;
+
+  const startTime = Date.now();
+  let timedOut = false;
+
+  try {
+    const stdout = execFileSync(execCommand, execArgs, {
+      cwd: execCwd,
+      env: execEnv,
+      timeout,
+      maxBuffer: 10 * 1024 * 1024,
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+
+    return res.status(200).json({
+      success: true,
+      exitCode: 0,
+      stdout: stdout || '',
+      stderr: '',
+      executionTimeMs: Date.now() - startTime,
+      timedOut: false,
+    });
+  } catch (error) {
+    timedOut = error.killed || false;
+
+    return res.status(200).json({
+      success: false,
+      exitCode: error.status != null ? error.status : 1,
+      stdout: error.stdout || '',
+      stderr: error.stderr || '',
+      executionTimeMs: Date.now() - startTime,
+      timedOut,
+    });
+  }
+};
+`;
+}
+
+// src/sandbox/index.ts
+var LOG_PREFIX = "[VercelSandbox]";
+var VERCEL_API_BASE = "https://api.vercel.com";
+function shellQuote(arg) {
+  if (/^[a-zA-Z0-9._\-\/=:@]+$/.test(arg)) return arg;
+  return `'${arg.replace(/'/g, "'\\''")}'`;
+}
+var VercelSandbox = class extends workspace.MastraSandbox {
+  id;
+  name = "VercelSandbox";
+  provider = "vercel";
+  status = "pending";
+  _token;
+  _teamId;
+  _projectName;
+  _regions;
+  _maxDuration;
+  _memory;
+  _env;
+  _commandTimeout;
+  _instructionsOverride;
+  _secret;
+  _deploymentUrl = null;
+  _deploymentId = null;
+  _protectionBypass = null;
+  _createdAt = null;
+  constructor(options = {}) {
+    super({ name: "VercelSandbox" });
+    this.id = `vercel-sandbox-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+    this._token = options.token || process.env.VERCEL_TOKEN || "";
+    this._teamId = options.teamId;
+    this._projectName = options.projectName;
+    this._regions = options.regions ?? ["iad1"];
+    this._maxDuration = options.maxDuration ?? 60;
+    this._memory = options.memory ?? 1024;
+    this._env = options.env ?? {};
+    this._commandTimeout = options.commandTimeout ?? 55e3;
+    this._instructionsOverride = options.instructions;
+    this._secret = crypto.randomUUID();
+  }
+  // ---------------------------------------------------------------------------
+  // Lifecycle
+  // ---------------------------------------------------------------------------
+  async start() {
+    if (this._deploymentUrl) {
+      return;
+    }
+    if (!this._token) {
+      throw new Error(`${LOG_PREFIX} Missing Vercel API token. Set VERCEL_TOKEN env var or pass token option.`);
+    }
+    if (this._deploymentId) {
+      this.logger.debug(`${LOG_PREFIX} Cleaning up stale deployment ${this._deploymentId} before restarting...`);
+      try {
+        const resp = await this._vercelFetch(`/v13/deployments/${this._deploymentId}`, { method: "DELETE" });
+        if (!resp.ok && resp.status !== 404) {
+          this.logger.warn(`${LOG_PREFIX} Failed to delete stale deployment: ${resp.status}`);
+        }
+      } catch (error) {
+        this.logger.warn(`${LOG_PREFIX} Error deleting stale deployment:`, error);
+      }
+      this._deploymentId = null;
+    }
+    this.logger.debug(`${LOG_PREFIX} Deploying executor function...`);
+    const vercelJson = JSON.stringify({
+      functions: {
+        "api/execute.js": {
+          memory: this._memory,
+          maxDuration: this._maxDuration
+        }
+      },
+      regions: this._regions
+    });
+    const deploymentBody = {
+      name: this._projectName ?? `mastra-sandbox-${this.id}`,
+      files: [
+        {
+          file: "api/execute.js",
+          data: getExecutorSource(this._secret, this._env)
+        },
+        {
+          file: "vercel.json",
+          data: vercelJson
+        }
+      ],
+      projectSettings: {
+        framework: null
+      },
+      target: "production"
+    };
+    const createResp = await this._vercelFetch("/v13/deployments", {
+      method: "POST",
+      body: JSON.stringify(deploymentBody)
+    });
+    if (!createResp.ok) {
+      const errorBody = await createResp.text();
+      throw new Error(`${LOG_PREFIX} Failed to create deployment: ${createResp.status} ${errorBody}`);
+    }
+    const deployment = await createResp.json();
+    this._deploymentId = deployment.id;
+    this.logger.debug(`${LOG_PREFIX} Deployment created: ${deployment.id}, polling for READY...`);
+    const maxWaitMs = 12e4;
+    const pollIntervalMs = 3e3;
+    const deadline = Date.now() + maxWaitMs;
+    while (Date.now() < deadline) {
+      const statusResp = await this._vercelFetch(`/v13/deployments/${deployment.id}`);
+      if (!statusResp.ok) {
+        throw new Error(`${LOG_PREFIX} Failed to check deployment status: ${statusResp.status}`);
+      }
+      const statusBody = await statusResp.json();
+      if (statusBody.readyState === "READY") {
+        this._deploymentUrl = `https://${statusBody.url}`;
+        this._createdAt = /* @__PURE__ */ new Date();
+        this.logger.debug(`${LOG_PREFIX} Deployment ready: ${this._deploymentUrl}`);
+        if (deployment.projectId) {
+          try {
+            this._protectionBypass = await this._acquireProtectionBypass(deployment.projectId);
+          } catch {
+          }
+        }
+        try {
+          await fetch(`${this._deploymentUrl}/api/execute`, {
+            method: "POST",
+            headers: this._executorHeaders(),
+            body: JSON.stringify({ command: "echo", args: ["warm"] })
+          });
+        } catch {
+        }
+        return;
+      }
+      if (statusBody.readyState === "ERROR" || statusBody.readyState === "CANCELED") {
+        throw new Error(`${LOG_PREFIX} Deployment failed with state: ${statusBody.readyState}`);
+      }
+      await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    }
+    throw new Error(`${LOG_PREFIX} Deployment timed out after ${maxWaitMs}ms`);
+  }
+  async stop() {
+    this._deploymentUrl = null;
+  }
+  async destroy() {
+    if (this._deploymentId) {
+      try {
+        const resp = await this._vercelFetch(`/v13/deployments/${this._deploymentId}`, {
+          method: "DELETE"
+        });
+        if (!resp.ok) {
+          if (resp.status === 404) {
+            this.logger.debug(`${LOG_PREFIX} Deployment already deleted (404)`);
+          } else {
+            this.logger.warn(`${LOG_PREFIX} Failed to delete deployment: ${resp.status}`);
+          }
+        }
+      } catch (error) {
+        this.logger.warn(`${LOG_PREFIX} Error deleting deployment:`, error);
+      }
+      this._deploymentId = null;
+    }
+    this._deploymentUrl = null;
+    this._protectionBypass = null;
+  }
+  // ---------------------------------------------------------------------------
+  // Command Execution
+  // ---------------------------------------------------------------------------
+  async executeCommand(command, args, options) {
+    await this.ensureRunning();
+    if (!this._deploymentUrl) {
+      throw new workspace.SandboxNotReadyError(this.id);
+    }
+    const fullCommand = args?.length ? `${command} ${args.map((a) => shellQuote(a)).join(" ")}` : command;
+    this.logger.debug(`${LOG_PREFIX} Executing: ${fullCommand}`);
+    const body = {
+      command,
+      args: args ?? [],
+      env: options?.env ?? {},
+      cwd: options?.cwd ?? "/tmp",
+      timeout: options?.timeout ?? this._commandTimeout
+    };
+    const maxRetries = 2;
+    let lastError = null;
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+      try {
+        const resp = await fetch(`${this._deploymentUrl}/api/execute`, {
+          method: "POST",
+          headers: this._executorHeaders(),
+          body: JSON.stringify(body),
+          signal: options?.abortSignal
+        });
+        if ((resp.status === 429 || resp.status === 502 || resp.status === 503) && attempt < maxRetries) {
+          this.logger.debug(`${LOG_PREFIX} Retryable status ${resp.status}, attempt ${attempt + 1}/${maxRetries}`);
+          await new Promise((resolve) => setTimeout(resolve, 1e3 * (attempt + 1)));
+          continue;
+        }
+        if (resp.status === 504) {
+          return {
+            command: fullCommand,
+            args,
+            success: false,
+            exitCode: 124,
+            stdout: "",
+            stderr: "Function execution timed out (504 Gateway Timeout)",
+            executionTimeMs: options?.timeout ?? this._commandTimeout,
+            timedOut: true
+          };
+        }
+        if (!resp.ok) {
+          const errorText = await resp.text();
+          throw new Error(`${LOG_PREFIX} Execute failed: ${resp.status} ${errorText}`);
+        }
+        const result = await resp.json();
+        if (options?.onStdout && result.stdout) {
+          options.onStdout(result.stdout);
+        }
+        if (options?.onStderr && result.stderr) {
+          options.onStderr(result.stderr);
+        }
+        return {
+          command: fullCommand,
+          args,
+          success: result.success,
+          exitCode: result.exitCode,
+          stdout: result.stdout,
+          stderr: result.stderr,
+          executionTimeMs: result.executionTimeMs,
+          timedOut: result.timedOut
+        };
+      } catch (error) {
+        if (error instanceof DOMException && error.name === "AbortError") {
+          throw error;
+        }
+        lastError = error;
+        if (attempt < maxRetries) {
+          this.logger.debug(`${LOG_PREFIX} Request error, attempt ${attempt + 1}/${maxRetries}:`, error);
+          await new Promise((resolve) => setTimeout(resolve, 1e3 * (attempt + 1)));
+          continue;
+        }
+      }
+    }
+    throw lastError ?? new Error(`${LOG_PREFIX} executeCommand failed after retries`);
+  }
+  // ---------------------------------------------------------------------------
+  // Info & Instructions
+  // ---------------------------------------------------------------------------
+  // Matches the resolveInstructions pattern in packages/core/src/workspace/utils.ts
+  getInstructions(opts) {
+    if (this._instructionsOverride === void 0) return this._getDefaultInstructions();
+    if (typeof this._instructionsOverride === "string") return this._instructionsOverride;
+    const defaultInstructions = this._getDefaultInstructions();
+    return this._instructionsOverride({ defaultInstructions, requestContext: opts?.requestContext });
+  }
+  _getDefaultInstructions() {
+    return [
+      "Vercel serverless sandbox.",
+      "Limitations:",
+      "- Stateless: no persistent filesystem between invocations.",
+      "- No interactive shell or streaming stdin.",
+      "- No long-running or background processes.",
+      `- Maximum execution time: ${this._maxDuration} seconds.`,
+      "- Only /tmp is writable (ephemeral, cleared between invocations).",
+      "- Shell commands (pipes, builtins) are supported via /bin/sh -c."
+    ].join("\n");
+  }
+  async getInfo() {
+    return {
+      id: this.id,
+      name: this.name,
+      provider: this.provider,
+      status: this.status,
+      createdAt: this._createdAt ?? /* @__PURE__ */ new Date(),
+      metadata: {
+        deploymentId: this._deploymentId,
+        deploymentUrl: this._deploymentUrl,
+        regions: this._regions,
+        maxDuration: this._maxDuration,
+        memory: this._memory
+      }
+    };
+  }
+  // ---------------------------------------------------------------------------
+  // Private Helpers
+  // ---------------------------------------------------------------------------
+  /**
+   * Fetch an existing protection bypass token for the project, or create one
+   * if none exists. Returns the token string, or null if acquisition fails.
+   */
+  async _acquireProtectionBypass(projectId) {
+    const projResp = await this._vercelFetch(`/v9/projects/${projectId}`);
+    if (projResp.ok) {
+      const project = await projResp.json();
+      const existing = project.protectionBypass ? Object.keys(project.protectionBypass)[0] : void 0;
+      if (existing) {
+        this.logger.debug(`${LOG_PREFIX} Using existing protection bypass token`);
+        return existing;
+      }
+    }
+    this.logger.debug(`${LOG_PREFIX} Creating protection bypass token...`);
+    const createResp = await this._vercelFetch(`/v1/projects/${projectId}/protection-bypass`, {
+      method: "PATCH",
+      body: JSON.stringify({})
+    });
+    if (createResp.ok) {
+      const result = await createResp.json();
+      const created = result.protectionBypass ? Object.keys(result.protectionBypass)[0] : void 0;
+      if (created) {
+        this.logger.debug(`${LOG_PREFIX} Protection bypass token created`);
+        return created;
+      }
+    }
+    this.logger.debug(`${LOG_PREFIX} Could not acquire protection bypass token (project may not require it)`);
+    return null;
+  }
+  _executorHeaders() {
+    const headers = {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${this._secret}`
+    };
+    if (this._protectionBypass) {
+      headers["x-vercel-protection-bypass"] = this._protectionBypass;
+    }
+    return headers;
+  }
+  async _vercelFetch(path, options = {}) {
+    const url = new URL(path, VERCEL_API_BASE);
+    if (this._teamId) {
+      url.searchParams.set("teamId", this._teamId);
+    }
+    return fetch(url.toString(), {
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${this._token}`,
+        ...options.headers ?? {}
+      }
+    });
+  }
+};
+
+// src/provider.ts
+var vercelSandboxProvider = {
+  id: "vercel",
+  name: "Vercel Sandbox",
+  description: "Serverless sandbox powered by Vercel Functions",
+  configSchema: {
+    type: "object",
+    properties: {
+      token: { type: "string", description: "Vercel API token" },
+      teamId: { type: "string", description: "Vercel team ID" },
+      projectName: { type: "string", description: "Existing Vercel project name" },
+      regions: {
+        type: "array",
+        description: "Deployment regions",
+        items: { type: "string" },
+        default: ["iad1"]
+      },
+      maxDuration: { type: "number", description: "Function max duration in seconds", default: 60 },
+      memory: { type: "number", description: "Function memory in MB", default: 1024 },
+      env: {
+        type: "object",
+        description: "Environment variables",
+        additionalProperties: { type: "string" }
+      },
+      commandTimeout: { type: "number", description: "Per-invocation timeout in ms", default: 55e3 }
+    }
+  },
+  createSandbox: (config) => new VercelSandbox(config)
+};
+var VercelMicroVMProcessHandle = class extends workspace.ProcessHandle {
+  pid;
+  _command;
+  _startTime;
+  _timeout;
+  _exitCode;
+  _waitPromise = null;
+  _streamingPromise = null;
+  _killed = false;
+  constructor(command, startTime, options) {
+    super(options);
+    this.pid = command.cmdId;
+    this._command = command;
+    this._startTime = startTime;
+    this._timeout = options?.timeout;
+  }
+  get exitCode() {
+    return this._exitCode;
+  }
+  /** @internal Set by the process manager after streaming starts. */
+  set streamingPromise(p) {
+    this._streamingPromise = p;
+  }
+  async wait() {
+    if (!this._waitPromise) {
+      this._waitPromise = this._doWait();
+    }
+    return this._waitPromise;
+  }
+  async _doWait() {
+    const finishedPromise = this._command.wait().then((finished) => {
+      if (this._exitCode === void 0) this._exitCode = finished.exitCode;
+    }).catch(() => {
+      if (this._exitCode === void 0) this._exitCode = 1;
+    });
+    if (this._timeout) {
+      let timeoutId;
+      const timeoutPromise = new Promise((resolve) => {
+        timeoutId = setTimeout(() => resolve("timeout"), this._timeout);
+      });
+      const outcome = await Promise.race([finishedPromise.then(() => "done"), timeoutPromise]);
+      clearTimeout(timeoutId);
+      if (outcome === "timeout") {
+        await this.kill();
+        this._exitCode = 124;
+        await this._streamingPromise?.catch(() => {
+        });
+        return {
+          success: false,
+          exitCode: 124,
+          stdout: this.stdout,
+          stderr: this.stderr || `Command timed out after ${this._timeout}ms`,
+          executionTimeMs: Date.now() - this._startTime,
+          killed: true,
+          timedOut: true
+        };
+      }
+    } else {
+      await finishedPromise;
+    }
+    await this._streamingPromise?.catch(() => {
+    });
+    if (this._killed) {
+      return {
+        success: false,
+        exitCode: this._exitCode ?? 137,
+        stdout: this.stdout,
+        stderr: this.stderr,
+        executionTimeMs: Date.now() - this._startTime,
+        killed: true,
+        timedOut: false
+      };
+    }
+    return {
+      success: this._exitCode === 0,
+      exitCode: this._exitCode ?? 1,
+      stdout: this.stdout,
+      stderr: this.stderr,
+      executionTimeMs: Date.now() - this._startTime
+    };
+  }
+  async kill() {
+    if (this._exitCode !== void 0 && !this._killed) return false;
+    this._killed = true;
+    if (this._exitCode === void 0) this._exitCode = 137;
+    try {
+      await this._command.kill();
+    } catch {
+    }
+    return true;
+  }
+  async sendStdin(_data) {
+    throw new Error("VercelMicroVMSandbox does not support sending stdin to running processes.");
+  }
+};
+var VercelMicroVMProcessManager = class extends workspace.SandboxProcessManager {
+  async spawn(command, options = {}) {
+    const mergedEnv = { ...this.env, ...options.env };
+    const env = Object.fromEntries(
+      Object.entries(mergedEnv).filter((entry) => entry[1] !== void 0)
+    );
+    const cmd = await this.sandbox.sandbox.runCommand({
+      cmd: "sh",
+      args: ["-c", command],
+      ...options.cwd ? { cwd: options.cwd } : {},
+      ...Object.keys(env).length ? { env } : {},
+      detached: true
+    });
+    const handle = new VercelMicroVMProcessHandle(cmd, Date.now(), options);
+    const streamingPromise = (async () => {
+      for await (const log of cmd.logs()) {
+        if (log.stream === "stdout") handle.emitStdout(log.data);
+        else handle.emitStderr(log.data);
+      }
+    })().catch(() => {
+    });
+    handle.streamingPromise = streamingPromise;
+    this._tracked.set(handle.pid, handle);
+    return handle;
+  }
+  async list() {
+    const result = [];
+    for (const [pid, handle] of this._tracked) {
+      result.push({
+        pid,
+        command: handle.command,
+        running: handle.exitCode === void 0,
+        exitCode: handle.exitCode
+      });
+    }
+    return result;
+  }
+};
+
+// src/microvm/index.ts
+var LOG_PREFIX2 = "[VercelMicroVMSandbox]";
+var VercelMicroVMSandbox = class extends workspace.MastraSandbox {
+  id;
+  name = "VercelMicroVMSandbox";
+  provider = "vercel-microvm";
+  status = "pending";
+  _sandbox = null;
+  _createdAt = null;
+  _sandboxName;
+  _token;
+  _teamId;
+  _projectId;
+  _runtime;
+  _timeout;
+  _vcpus;
+  _ports;
+  _env;
+  _metadata;
+  _instructionsOverride;
+  constructor(options = {}) {
+    super({
+      ...options,
+      name: "VercelMicroVMSandbox",
+      processes: new VercelMicroVMProcessManager({ env: options.env ?? {} })
+    });
+    this.id = options.id ?? `vercel-microvm-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+    this._sandboxName = options.sandboxName;
+    this._token = options.token ?? process.env.VERCEL_TOKEN;
+    this._teamId = options.teamId ?? process.env.VERCEL_TEAM_ID;
+    this._projectId = options.projectId ?? process.env.VERCEL_PROJECT_ID;
+    this._runtime = options.runtime ?? "node24";
+    this._timeout = options.timeout ?? 3e5;
+    this._vcpus = options.resources?.vcpus;
+    this._ports = options.ports;
+    this._env = options.env ?? {};
+    this._metadata = options.metadata ?? {};
+    this._instructionsOverride = options.instructions;
+  }
+  /**
+   * The underlying `@vercel/sandbox` instance.
+   * Throws if the sandbox has not been started yet.
+   */
+  get sandbox() {
+    if (!this._sandbox) {
+      throw new workspace.SandboxNotReadyError(this.id);
+    }
+    return this._sandbox;
+  }
+  // ---------------------------------------------------------------------------
+  // Lifecycle
+  // ---------------------------------------------------------------------------
+  async start() {
+    if (this._sandbox) {
+      return;
+    }
+    const hasExplicitCreds = Boolean(this._token || this._teamId || this._projectId);
+    if (hasExplicitCreds && !(this._token && this._teamId && this._projectId)) {
+      throw new Error(
+        `${LOG_PREFIX2} Incomplete credentials. Provide token, teamId, and projectId together (or the VERCEL_TOKEN, VERCEL_TEAM_ID, and VERCEL_PROJECT_ID env vars), or omit all three to use the VERCEL_OIDC_TOKEN.`
+      );
+    }
+    this.logger.debug(`${LOG_PREFIX2} Creating sandbox...`, { runtime: this._runtime, timeout: this._timeout });
+    this._sandbox = await sandbox.Sandbox.create({
+      ...this._sandboxName ? { name: this._sandboxName } : {},
+      runtime: this._runtime,
+      timeout: this._timeout,
+      ...this._vcpus ? { resources: { vcpus: this._vcpus } } : {},
+      ...this._ports?.length ? { ports: this._ports } : {},
+      ...Object.keys(this._env).length ? { env: this._env } : {},
+      ...hasExplicitCreds ? { token: this._token, teamId: this._teamId, projectId: this._projectId } : {}
+    });
+    this._createdAt = /* @__PURE__ */ new Date();
+    this.logger.debug(`${LOG_PREFIX2} Sandbox ready: ${this._sandbox.name}`);
+  }
+  async stop() {
+    await this._teardown();
+  }
+  async destroy() {
+    await this._teardown();
+  }
+  async _teardown() {
+    if (!this._sandbox) {
+      return;
+    }
+    try {
+      await this._sandbox.stop();
+    } catch (error) {
+      this.logger.warn(`${LOG_PREFIX2} Error stopping sandbox:`, error);
+    }
+    this._sandbox = null;
+  }
+  // ---------------------------------------------------------------------------
+  // Command Execution
+  // ---------------------------------------------------------------------------
+  async executeCommand(command, args, options) {
+    await this.ensureRunning();
+    const startTime = Date.now();
+    const fullCommand = args?.length ? `${command} ${args.join(" ")}` : command;
+    this.logger.debug(`${LOG_PREFIX2} Executing: ${fullCommand}`, { cwd: options?.cwd });
+    const mergedEnv = { ...this._env, ...options?.env };
+    const env = Object.fromEntries(
+      Object.entries(mergedEnv).filter((entry) => entry[1] !== void 0)
+    );
+    let timeoutId;
+    const abortController = new AbortController();
+    const forwardAbort = () => abortController.abort();
+    if (options?.abortSignal) {
+      if (options.abortSignal.aborted) abortController.abort();
+      else options.abortSignal.addEventListener("abort", forwardAbort, { once: true });
+    }
+    const signal = abortController.signal;
+    const timeoutPromise = options?.timeout ? new Promise((resolve) => {
+      timeoutId = setTimeout(() => resolve("timeout"), options.timeout);
+    }) : null;
+    try {
+      const commandPromise = this.sandbox.runCommand({
+        cmd: command,
+        args: args ?? [],
+        ...options?.cwd ? { cwd: options.cwd } : {},
+        ...Object.keys(env).length ? { env } : {},
+        signal
+      });
+      const finished = timeoutPromise ? await Promise.race([commandPromise, timeoutPromise]) : await commandPromise;
+      if (finished === "timeout") {
+        abortController.abort();
+        return {
+          command: fullCommand,
+          args,
+          success: false,
+          exitCode: 124,
+          stdout: "",
+          stderr: `Command timed out after ${options.timeout}ms`,
+          executionTimeMs: Date.now() - startTime,
+          timedOut: true
+        };
+      }
+      const [stdout, stderr] = await Promise.all([finished.stdout(), finished.stderr()]);
+      if (options?.onStdout && stdout) options.onStdout(stdout);
+      if (options?.onStderr && stderr) options.onStderr(stderr);
+      return {
+        command: fullCommand,
+        args,
+        success: finished.exitCode === 0,
+        exitCode: finished.exitCode,
+        stdout,
+        stderr,
+        executionTimeMs: Date.now() - startTime
+      };
+    } finally {
+      if (timeoutId) clearTimeout(timeoutId);
+      options?.abortSignal?.removeEventListener("abort", forwardAbort);
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // Info & Instructions
+  // ---------------------------------------------------------------------------
+  getInfo() {
+    const domains = {};
+    if (this._sandbox && this._ports?.length) {
+      for (const port of this._ports) {
+        try {
+          domains[port] = this._sandbox.domain(port);
+        } catch {
+        }
+      }
+    }
+    return {
+      id: this.id,
+      name: this.name,
+      provider: this.provider,
+      status: this.status,
+      createdAt: this._createdAt ?? /* @__PURE__ */ new Date(),
+      metadata: {
+        ...this._metadata,
+        sandboxName: this._sandbox?.name,
+        runtime: this._runtime,
+        timeout: this._timeout,
+        ...this._vcpus ? { vcpus: this._vcpus } : {},
+        ...this._ports?.length ? { ports: this._ports, domains } : {}
+      }
+    };
+  }
+  // Matches the resolveInstructions pattern in @mastra/core/workspace.
+  getInstructions(opts) {
+    if (this._instructionsOverride === void 0) return this._getDefaultInstructions();
+    if (typeof this._instructionsOverride === "string") return this._instructionsOverride;
+    const defaultInstructions = this._getDefaultInstructions();
+    return this._instructionsOverride({ defaultInstructions, requestContext: opts?.requestContext });
+  }
+  _getDefaultInstructions() {
+    return [
+      "Vercel Sandbox: an ephemeral Firecracker MicroVM running Amazon Linux 2023.",
+      `- Runtime: ${this._runtime}. Working directory defaults to /vercel/sandbox.`,
+      "- Persistent filesystem within the session; state is lost when the sandbox stops.",
+      "- Runs as the vercel-sandbox user with sudo access (install packages via dnf).",
+      `- The sandbox auto-terminates after ${Math.round(this._timeout / 1e3)} seconds.`,
+      ...this._ports?.length ? [`- Exposed ports: ${this._ports.join(", ")} (reachable via public HTTPS domains).`] : [],
+      "- Background/long-running processes are supported via the process tools.",
+      "- Filesystem mounting (FUSE) is not supported."
+    ].join("\n");
+  }
+};
+
+// src/microvm-provider.ts
+var vercelMicroVMSandboxProvider = {
+  id: "vercel-microvm",
+  name: "Vercel Sandbox (MicroVM)",
+  description: "Ephemeral Firecracker MicroVM sandbox powered by Vercel Sandbox",
+  configSchema: {
+    type: "object",
+    properties: {
+      token: { type: "string", description: "Vercel API token (falls back to VERCEL_TOKEN; omit to use OIDC)" },
+      teamId: { type: "string", description: "Vercel team ID (falls back to VERCEL_TEAM_ID)" },
+      projectId: { type: "string", description: "Vercel project ID (falls back to VERCEL_PROJECT_ID)" },
+      runtime: {
+        type: "string",
+        description: "Sandbox runtime",
+        enum: ["node24", "node22", "node26", "python3.13"],
+        default: "node24"
+      },
+      timeout: { type: "number", description: "Auto-terminate timeout in milliseconds", default: 3e5 },
+      vcpus: { type: "number", description: "Number of vCPUs (2048 MB memory per vCPU)" },
+      ports: {
+        type: "array",
+        description: "Ports to expose (up to 4)",
+        items: { type: "number" }
+      },
+      env: {
+        type: "object",
+        description: "Environment variables",
+        additionalProperties: { type: "string" }
+      }
+    }
+  },
+  createSandbox: (config) => new VercelMicroVMSandbox({
+    token: config.token,
+    teamId: config.teamId,
+    projectId: config.projectId,
+    runtime: config.runtime,
+    timeout: config.timeout,
+    ...config.vcpus ? { resources: { vcpus: config.vcpus } } : {},
+    ports: config.ports,
+    env: config.env
+  })
+};
+
+exports.VercelMicroVMProcessManager = VercelMicroVMProcessManager;
+exports.VercelMicroVMSandbox = VercelMicroVMSandbox;
+exports.VercelSandbox = VercelSandbox;
+exports.vercelMicroVMSandboxProvider = vercelMicroVMSandboxProvider;
+exports.vercelSandboxProvider = vercelSandboxProvider;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map