@marimo-team/frontend 0.24.3-dev55 → 0.24.3-dev58

package/src/core/wasm/bridge.ts

@@ -9,6 +9,7 @@ import { throwNotImplemented } from "@/utils/functions";
 import { Logger } from "@/utils/Logger";
 import { reloadSafe } from "@/utils/reload-safe";
 import { generateUUID } from "@/utils/uuid";
+import { createModuleWorker } from "@/utils/worker";
 import { notebookIsRunningAtom } from "../cells/cells";
 import type { CommandMessage } from "../kernel/messages";
 import { getMarimoVersion } from "../meta/globals";
@@ -41,10 +42,13 @@ import { BasicTransport } from "../websocket/transports/basic";
 import type { IConnectionTransport } from "../websocket/transports/transport";
 import { PyodideRouter } from "./router";
 import { getWorkerRPC } from "./rpc";
+import { getWasmRuntimeConfig } from "./runtime-config";
 import { createShareableLink } from "./share";
 import { wasmInitStateAtom } from "./state";
 import { fallbackFileStore, notebookFileStore } from "./store";
 import { isWasm } from "./utils";
+import saveWorkerUrl from "./worker/save-worker.ts?worker&url";
+import workerUrl from "./worker/worker.ts?worker&url";
 import type { SaveWorkerSchema } from "./worker/save-worker";
 import type { WorkerSchema } from "./worker/worker";
 
@@ -81,19 +85,20 @@ export class PyodideBridge implements RunRequests, EditRequests {
       };
     }
 
+    const runtimeConfig = getWasmRuntimeConfig();
+
     // Create save worker
-    const saveWorker = new Worker(
-      // oxlint-disable-next-line unicorn/relative-url-style
-      new URL("./worker/save-worker.ts", import.meta.url),
+    const saveWorker = createModuleWorker(
+      new URL(saveWorkerUrl, import.meta.url),
       {
-        type: "module",
         // Pass the version (and optional capability suffix) to the worker
-        /* @vite-ignore */
         name: getWasmWorkerName(),
       },
     );
 
-    return getWorkerRPC<SaveWorkerSchema>(saveWorker).proxy.request;
+    const rpc = getWorkerRPC<SaveWorkerSchema>(saveWorker);
+    rpc.send.bootstrap(runtimeConfig);
+    return rpc.proxy.request;
   }
 
   private constructor() {
@@ -101,20 +106,17 @@ export class PyodideBridge implements RunRequests, EditRequests {
       return;
     }
 
+    const runtimeConfig = getWasmRuntimeConfig();
+
     // Create a worker
-    const worker = new Worker(
-      // oxlint-disable-next-line unicorn/relative-url-style
-      new URL("./worker/worker.ts", import.meta.url),
-      {
-        type: "module",
-        // Pass the version (and optional capability suffix) to the worker
-        /* @vite-ignore */
-        name: getWasmWorkerName(),
-      },
-    );
+    const worker = createModuleWorker(new URL(workerUrl, import.meta.url), {
+      // Pass the version (and optional capability suffix) to the worker
+      name: getWasmWorkerName(),
+    });
 
     // Create the RPC
     this.rpc = getWorkerRPC<WorkerSchema>(worker);
+    this.rpc.send.bootstrap(runtimeConfig);
 
     // Listeners
     this.rpc.addMessageListener("ready", () => {

package/src/core/wasm/rpc.ts

@@ -6,11 +6,13 @@ import {
   type RPCSchema,
 } from "rpc-anywhere";
 import { Logger } from "@/utils/Logger";
+import type { WasmRuntimeConfig } from "./runtime-config";
 import { TRANSPORT_ID } from "./worker/constants";
 
 export type ParentSchema = RPCSchema<{
   messages: {
     consumerReady: {};
+    bootstrap: WasmRuntimeConfig;
   };
 }>;
 

package/src/core/wasm/runtime-config.ts

@@ -0,0 +1,27 @@
+/* Copyright 2026 Marimo. All rights reserved. */
+
+export interface WasmRuntimeConfig {
+  pyodideIndexUrl?: string;
+  pyodideLockfileUrl?: string;
+  pypiIndexUrl?: string;
+}
+
+export function getWasmRuntimeConfig(): WasmRuntimeConfig {
+  const element = document.querySelector<HTMLElement>("marimo-wasm");
+  const resolve = (url: string | undefined) => {
+    try {
+      return url ? new URL(url, document.baseURI).href : undefined;
+    } catch {
+      return undefined;
+    }
+  };
+  return {
+    pyodideIndexUrl: resolve(element?.dataset.pyodideIndexUrl),
+    pyodideLockfileUrl: resolve(element?.dataset.pyodideLockfileUrl),
+    // URL serialization escapes the placeholder understood by micropip.
+    pypiIndexUrl: resolve(element?.dataset.pypiIndexUrl)?.replaceAll(
+      "%7Bpackage_name%7D",
+      "{package_name}",
+    ),
+  };
+}

package/src/core/wasm/worker/bootstrap.ts

@@ -41,10 +41,9 @@ export class DefaultWasmController implements WasmController {
     return this.pyodide;
   }
 
-  async bootstrap(opts: {
-    version: string;
-    pyodideVersion: string;
-  }): Promise<PyodideInterface> {
+  async bootstrap(
+    opts: Parameters<WasmController["bootstrap"]>[0],
+  ): Promise<PyodideInterface> {
     const pyodide = await this.loadPyodideAndPackages(opts);
 
     if (MAKE_SNAPSHOT) {
@@ -55,10 +54,9 @@ export class DefaultWasmController implements WasmController {
     return pyodide;
   }
 
-  private async loadPyodideAndPackages(opts: {
-    version: string;
-    pyodideVersion: string;
-  }): Promise<PyodideInterface> {
+  private async loadPyodideAndPackages(
+    opts: Parameters<WasmController["bootstrap"]>[0],
+  ): Promise<PyodideInterface> {
     if (!loadPyodide) {
       throw new Error("loadPyodide is not defined");
     }
@@ -68,7 +66,9 @@ export class DefaultWasmController implements WasmController {
       // Without this, this fails in Firefox with
       // `Could not extract indexURL path from pyodide module`
       // This fixes for Firefox and does not break Chrome/others
-      const indexURL = `https://cdn.jsdelivr.net/pyodide/${opts.pyodideVersion}/full/`;
+      const indexURL =
+        opts.pyodideIndexUrl ??
+        `https://cdn.jsdelivr.net/pyodide/${opts.pyodideVersion}/full/`;
       const pyodide = await loadPyodide({
         // Perf: These get loaded while pyodide is being bootstrapped
         packages: [
@@ -81,16 +81,26 @@ export class DefaultWasmController implements WasmController {
           "packaging",
         ],
         _makeSnapshot: MAKE_SNAPSHOT,
-        lockFileURL: `https://wasm.marimo.app/pyodide-lock.json?v=${opts.version}&pyodide=${opts.pyodideVersion}`,
+        lockFileURL:
+          opts.pyodideLockfileUrl ??
+          `https://wasm.marimo.app/pyodide-lock.json?v=${opts.version}&pyodide=${opts.pyodideVersion}`,
         indexURL,
         // Since Pyodide 0.28.0, when lockFileURL is set, the package base URL
         // defaults to the lockfile's URL (wasm.marimo.app) instead of indexURL.
         // Unlike Node, browsers get no CDN fallback on a failed fetch, so we
-        // should pin packageBaseUrl back to the jsDelivr CDN  to restore
+        // should pin packageBaseUrl to indexURL to restore
         // the resolution akin to pre-0.28.
         packageBaseUrl: indexURL,
         convertNullToNone: true,
       });
+      if (opts.pypiIndexUrl) {
+        const micropip = pyodide.pyimport("micropip");
+        try {
+          micropip.set_index_urls(opts.pypiIndexUrl);
+        } finally {
+          micropip.destroy();
+        }
+      }
       this.pyodide = pyodide;
       span.end("ok");
       return pyodide;

package/src/core/wasm/worker/fs.ts

@@ -20,6 +20,10 @@ export const WasmFileSystem = {
     FS.chdir(HOME_DIR);
   },
   mountFS: (pyodide: PyodideInterface) => {
+    // Opaque origins (single-file exports) use the in-memory filesystem.
+    if (globalThis.origin === "null") {
+      return;
+    }
     const FS = getFS(pyodide);
     // Mount the filesystem
     FS.mount(pyodide.FS.filesystems.IDBFS, { root: "." }, HOME_DIR);

package/src/core/wasm/worker/save-worker.ts

@@ -9,9 +9,11 @@ import {
 } from "rpc-anywhere";
 import type { SaveNotebookRequest } from "@/core/network/types";
 import { decodeUtf8 } from "@/utils/strings";
+import { Deferred } from "../../../utils/Deferred";
 import { prettyError } from "../../../utils/errors";
 import { Logger } from "../../../utils/Logger";
 import type { ParentSchema } from "../rpc";
+import type { WasmRuntimeConfig } from "../runtime-config";
 import { TRANSPORT_ID } from "./constants";
 import { WasmFileSystem } from "./fs";
 import { getController } from "./getController";
@@ -25,6 +27,8 @@ declare const self: Window & {
   pyodide: PyodideInterface;
 };
 
+const runtimeConfig = new Deferred<WasmRuntimeConfig>();
+
 // Initialize
 async function loadPyodideAndPackages() {
   try {
@@ -36,6 +40,7 @@ async function loadPyodideAndPackages() {
     const controller = await getController(marimoVersion);
     self.controller = controller;
     self.pyodide = await controller.bootstrap({
+      ...(await runtimeConfig.promise),
       version: marimoVersion,
       pyodideVersion: pyodideVersion,
     });
@@ -100,6 +105,8 @@ const rpc = createRPC<SaveWorkerSchema, ParentSchema>({
   requestHandler,
 });
 
+rpc.addMessageListener("bootstrap", (config) => runtimeConfig.resolve(config));
+
 rpc.send("ready", {});
 
 function getMarimoVersion() {

package/src/core/wasm/worker/types.ts

@@ -1,5 +1,6 @@
 /* Copyright 2026 Marimo. All rights reserved. */
 import type { PyodideInterface } from "pyodide";
+import type { WasmRuntimeConfig } from "../runtime-config";
 import type { UserConfig } from "@/core/config/config-schema";
 import type {
   CommandMessage,
@@ -43,10 +44,12 @@ export interface WasmController {
    * Prepare the wasm environment
    * @param opts.version - The marimo version
    */
-  bootstrap(opts: {
-    version: string;
-    pyodideVersion: string;
-  }): Promise<PyodideInterface>;
+  bootstrap(
+    opts: WasmRuntimeConfig & {
+      version: string;
+      pyodideVersion: string;
+    },
+  ): Promise<PyodideInterface>;
   /**
    * Mount the filesystem
    * @param opts.code - The code to mount

package/src/core/wasm/worker/worker.ts

@@ -22,6 +22,7 @@ import { prettyError } from "../../../utils/errors";
 import { invariant } from "../../../utils/invariant";
 import { Logger } from "../../../utils/Logger";
 import type { ParentSchema } from "../rpc";
+import type { WasmRuntimeConfig } from "../runtime-config";
 import { TRANSPORT_ID } from "./constants";
 import { WasmFileSystem } from "./fs";
 import { getController } from "./getController";
@@ -47,6 +48,8 @@ declare const self: Window & {
 
 const workerInitSpan = t.startSpan("worker:init");
 
+const runtimeConfig = new Deferred<WasmRuntimeConfig>();
+
 // Initialize pyodide
 async function loadPyodideAndPackages() {
   try {
@@ -58,6 +61,7 @@ async function loadPyodideAndPackages() {
       message: "Loading marimo...",
     });
     self.pyodide = await t.wrapAsync(controller.bootstrap.bind(controller))({
+      ...(await runtimeConfig.promise),
       version: marimoVersion,
       pyodideVersion: pyodideVersion,
     });
@@ -354,6 +358,8 @@ const rpc = createRPC<WorkerSchema, ParentSchema>({
   requestHandler,
 });
 
+rpc.addMessageListener("bootstrap", (config) => runtimeConfig.resolve(config));
+
 rpc.send("ready", {});
 
 /// Listeners

package/src/utils/__tests__/worker.test.ts

@@ -0,0 +1,81 @@
+/* Copyright 2026 Marimo. All rights reserved. */
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { createModuleWorker } from "../worker";
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+  vi.restoreAllMocks();
+});
+
+describe("createModuleWorker", () => {
+  it.each(["http", "blob"])(
+    "preserves caller-owned %s worker URLs",
+    (scheme) => {
+      const Worker = vi.fn(function (
+        _url: string | URL,
+        _options: WorkerOptions,
+      ) {
+        return {};
+      });
+      vi.stubGlobal("Worker", Worker);
+      const url = new URL(
+        scheme === "blob"
+          ? `blob:${location.origin}/worker`
+          : new URL("/worker.js", location.href),
+      );
+      const revoke = vi.spyOn(URL, "revokeObjectURL");
+      createModuleWorker(url, { name: "marimo" });
+      expect(Worker).toHaveBeenCalledWith(url.href, {
+        type: "module",
+        name: "marimo",
+      });
+      expect(revoke).not.toHaveBeenCalled();
+    },
+  );
+
+  it("preserves the page origin for hosted CDN workers", () => {
+    const Worker = vi.fn(function (
+      _url: string | URL,
+      _options: WorkerOptions,
+    ) {
+      return {};
+    });
+    vi.stubGlobal("Worker", Worker);
+    const create = vi
+      .spyOn(URL, "createObjectURL")
+      .mockReturnValue("blob:worker");
+    const revoke = vi
+      .spyOn(URL, "revokeObjectURL")
+      .mockImplementation(() => undefined);
+    createModuleWorker(new URL("https://cdn.example.com/worker.js"), {
+      name: "islands",
+    });
+    expect(create).toHaveBeenCalledWith(expect.any(Blob));
+    expect(Worker).toHaveBeenCalledWith("blob:worker", {
+      type: "module",
+      name: "islands",
+    });
+    expect(revoke).toHaveBeenCalledWith("blob:worker");
+  });
+
+  it("imports a CDN worker from an opaque origin", () => {
+    const Worker = vi.fn(function (
+      _url: string | URL,
+      _options: WorkerOptions,
+    ) {
+      return {};
+    });
+    vi.stubGlobal("Worker", Worker);
+    vi.stubGlobal("origin", "null");
+    const url = new URL("https://cdn.example.com/worker.js");
+    createModuleWorker(url, { name: "0.24.2::controller" });
+    const [source, options] = Worker.mock.calls[0];
+    expect(decodeURIComponent(String(source))).toBe(
+      'data:application/javascript,import "https://cdn.example.com/worker.js"',
+    );
+    expect(options).toEqual({
+      type: "module",
+      name: "0.24.2::controller",
+    });
+  });
+});

package/src/utils/worker.ts

@@ -0,0 +1,22 @@
+/* Copyright 2026 Marimo. All rights reserved. */
+
+/** Load a module worker across origins, including from file:// pages. */
+export function createModuleWorker(url: URL, options: WorkerOptions): Worker {
+  if (url.origin === globalThis.origin) {
+    return new Worker(url.href, { ...options, type: "module" });
+  }
+  const js = `import ${JSON.stringify(url.href)}`;
+  // Blob workers preserve the page origin, but file:// needs a data URL.
+  const source =
+    globalThis.origin === "null"
+      ? `data:application/javascript,${encodeURIComponent(js)}`
+      : URL.createObjectURL(new Blob([js], { type: "application/javascript" }));
+  try {
+    return new Worker(source, { ...options, type: "module" });
+  } finally {
+    if (source.startsWith("blob:")) {
+      // Worker() captures the Blob before returning, even while imports load.
+      URL.revokeObjectURL(source);
+    }
+  }
+}

package/dist/assets/__vite-browser-external-BzcgEWaD.js

@@ -1 +0,0 @@
-import{t as e}from"./worker-BXMsnprR.js";var t=e(((e,t)=>{t.exports={}}));export default t();

package/dist/assets/__vite-browser-external-D87rEcrz.js

@@ -1 +0,0 @@
-import{t as e}from"./save-worker-BstmibH4.js";var t=e(((e,t)=>{t.exports={}}));export default t();

package/dist/assets/has-DZ-sm-ft.js

@@ -1 +0,0 @@
-import{Ka as e}from"./index-DKfkO1Lu.js";var t=Object.prototype.hasOwnProperty;function n(e,n){return e!=null&&t.call(e,n)}function r(t,r){return t!=null&&e(t,r,n)}export{r as t};