@ms-cloudpack/esm-stub-utilities 0.6.26 → 0.7.1

package/lib/runInSandbox.js

@@ -1,119 +1,91 @@
 import fs from 'fs';
-import fsPromises from 'fs/promises';
 import path from 'path';
-import { builtinModules, createRequire } from 'module';
 import { fileURLToPath } from 'url';
-import { NodeVM, VMError } from 'vm2';
-import { findPackageRoot } from '@ms-cloudpack/path-utilities';
-import { readJsonSync } from '@ms-cloudpack/json-utilities';
-const require = createRequire(import.meta.url);
-const filename = fileURLToPath(import.meta.url);
-const dirname = path.dirname(filename);
-const browserEnvSetup = path.join(path.dirname(dirname), 'browserEnvironment/index.cjs');
-/** Allow the sandbox to load these built-in modules */
-// ('events' and 'stream' export classes which other things extend and can't be proxied)
-const allowedBuiltins = ['buffer', 'events', 'path', 'stream', 'url', 'util'];
-/** Empty mocks of all built-in modules that aren't allowed (to ensure that requires succeed) */
-const mockBuiltins = Object.fromEntries(builtinModules.filter((m) => !allowedBuiltins.includes(m)).map((m) => [m, {}]));
-/** Mapping from sandbox root to VM */
-const vms = {};
-/** Mapping from directory to sandbox root */
-const sandboxRoots = {};
-/** Sandbox root for this file and other cloudpack-related files */
-let cloudpackSandboxRoot = '';
-/** Reset `vms` and `sandboxRoots` for testing */
-export function _clearSandboxCaches() {
-    Object.keys(vms).forEach((k) => delete vms[k]);
-    Object.keys(sandboxRoots).forEach((k) => delete sandboxRoots[k]);
+import { Worker } from 'worker_threads';
+import { slash } from '@ms-cloudpack/path-string-parsing';
+/** Some known error codes that can occur when running a file in a sandbox. */
+const errorCodes = {
+    requireESM: 'ERR_REQUIRE_ESM',
+    moduleNotFound: 'MODULE_NOT_FOUND',
+};
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const workerPath = path.join(dirname, 'worker/worker.js');
+// TODO do we need a pool?
+let worker;
+/** Stop the worker for testing */
+export async function _stopWorker() {
+    await worker?.terminate();
+    worker = undefined;
 }
-/** Get `vms` state for testing */
-export function _getSandboxVms() {
-    return vms;
-}
-/**
- * Try to figure out a root directory where the sandbox should be allowed to require files from.
- * This prefers the git root if found, falling back to package root or parent directory.
- *
- * (This is very likely overly permissive and might be good to restrict in the future.)
- */
-function findSandboxRoot(filePath) {
-    const root = path.parse(filePath).root;
-    let dir = path.dirname(filePath);
-    if (!sandboxRoots[dir]) {
-        // Try to find a git root first
-        while (dir !== root && !fs.existsSync(path.join(dir, '.git'))) {
-            dir = path.dirname(dir);
-        }
-        if (dir === root) {
-            // If there's a node_modules segment in the path, take the part before that. This covers two cases:
-            // - The entry file's sandbox when running cloudpack in a dependency package folder within node_modules
-            // - The cloudpack browser environment sandbox when using globally installed cloudpack
-            const nodeModulesMatch = filePath.match(/^(.*?)[\\/]node_modules[\\/]/);
-            if (nodeModulesMatch) {
-                dir = nodeModulesMatch[1];
-            }
-            else {
-                // Try to find a package root, or fall back to parent directory
-                dir = findPackageRoot(filePath) || path.dirname(filePath);
-            }
-        }
-        sandboxRoots[dir] = dir;
+function processError(error) {
+    const { message, code, name: errorName } = error;
+    let newMessage;
+    let type;
+    if (code === errorCodes.moduleNotFound) {
+        // Remove the require stack from MODULE_NOT_FOUND errors (we'll handle it separately).
+        //   Error: Cannot find module 'foo'
+        //   Require stack:
+        //   - [...]/index.js
+        //   - [.]/worker.js
+        newMessage = message.split('\n')[0];
+        type = 'module-not-found';
     }
-    return sandboxRoots[dir];
-}
-function handleError(action, err, sandboxRoot) {
-    const message = err.message || String(err);
-    const stack = err.stack?.split(/\r?\n/g) || [];
-    // instanceof checks don't work with errors from code run within the sandbox, but name is preserved
-    const errorName = err.name;
-    const newMessage = [`Error ${action}:`, message];
-    if (stack.length && err instanceof VMError && err.message.includes('Cannot find module')) {
-        newMessage.push('', 'Ensure that this file exists on disk. If it exists, this may be a bug with the choice of `root` ' +
-            '(allowed parent directories) settings in @ms-cloudpack/esm-stub-utilities runInSandbox.', `- Root for file being stubbed: ${sandboxRoot}`, `- Root for cloudpack files: ${cloudpackSandboxRoot}`);
-        // Find the actual line which caused the error
-        const errorLines = stack.filter((line) => line.trim().startsWith('at') && !line.includes('vm2'));
-        if (errorLines.length) {
-            newMessage.push('', 'Code that may have required this module:', ...errorLines);
-        }
-    }
-    else if (errorName === 'TypeError') {
-        newMessage.push('', 'If the code was referencing a built-in global or a property of a Node built-in module, ' +
-            'this error may be caused by a missing mock or other issue with the sandbox environment ' +
-            'configured in @ms-cloudpack/esm-stub-utilities runInSandbox.');
+    else if (code === errorCodes.requireESM) {
+        // Remove the instruction to change to a dynamic import, since it's less likely to be applicable here.
+        //   Error [ERR_REQUIRE_ESM]: require() of ES Module [...]/esm.mjs not supported.
+        //   Instead change the require of [...]/esm.mjs to a dynamic import() which is available in all CommonJS modules.
+        newMessage = message.split('\n')[0];
+        type = 'require-esm';
     }
-    else if (errorName === 'SyntaxError' &&
-        (/Unexpected token '(import|export)'/.test(message) ||
-            message.includes(`'import' and 'export' may appear only with`))) {
-        newMessage.push('', "It appears you're trying to load an ES module, which is not currently supported in the sandbox. " +
-            'If this module is loaded at startup within a CommonJS file, please file an issue with cloudpack. ');
+    else if (errorName === 'SyntaxError') {
+        newMessage = message;
+        type = 'invalid-syntax';
     }
-    if (stack.length) {
-        newMessage.push('', 'Original stack:', ...stack.slice(1));
-    }
-    throw new Error(newMessage.join('\n'));
-}
-function logMissingModule(params) {
-    const { moduleName, parentDir, error, realParentDir } = params;
-    // First determine if moduleName is from an optional peer dependency
-    let isOptionalPeerDep = false;
-    const depName = moduleName.match(/^(@[\w.-]+\/)?[\w.-]+/)?.[0];
-    const parentPkgRoot = depName ? findPackageRoot(parentDir) : undefined;
-    if (depName && parentPkgRoot) {
-        // eslint-disable-next-line @ms-cloudpack/internal/no-sync-filesystem
-        const packageJson = readJsonSync(path.join(parentPkgRoot, 'package.json'));
-        isOptionalPeerDep = !!(packageJson?.peerDependencies?.[depName] && packageJson.peerDependenciesMeta?.[depName]?.optional);
+    else {
+        newMessage = message;
+        type = 'other-error';
     }
-    // If the module is from an optional dep, it's not useful to warn
-    if (!isOptionalPeerDep) {
-        const realPathMsg = realParentDir ? ` (real path: ${realParentDir})` : '';
-        console.warn(`runInSandbox failed to resolve "${moduleName}" from "${parentDir}"${realPathMsg}: ${error}`);
+    let stack;
+    if (error.stack) {
+        // Get stack frame lines from the original error stack
+        stack = error.stack
+            .split('\n')
+            .filter((line) => /^\s+at /.test(line))
+            .map((line) => line.trim());
+        // Remove the worker frame and anything after it
+        const workerIndex = stack.findIndex((line) => slash(line).includes('esm-stub-utilities') && line.includes('worker.js'));
+        if (workerIndex !== -1) {
+            stack = stack.slice(0, workerIndex);
+        }
+        if (!stack.length) {
+            stack = undefined;
+            if (code === errorCodes.requireESM) {
+                // This error code + no stack outside the worker strongly implies that the file itself
+                // If we ended up with no stack besides the worker, this strongly implies that the file
+                // itself is an ESM file, not a CommonJS file.
+                newMessage =
+                    "It appears you're trying to create a stub of an ES module, which is not supported. " +
+                        'You may need to add a cloudpack override to bundle this package with ori.';
+                type = 'entry-is-esm';
+            }
+        }
     }
+    // Remove node internals from the stack
+    const partialStack = stack?.filter((line) => !line.includes('(node:'));
+    return {
+        message: newMessage,
+        type,
+        partialStack: partialStack?.length ? partialStack : undefined,
+    };
 }
 /**
  * Run a CommonJS file within a sandboxed environment.
  * @param entryPath - Path to a CommonJS file to run in a sandbox (does not work with ESM files)
- * @returns The module's exports
+ * @returns Info about the file's exports, or error info if there was an issue.
+ * Should only throw an error on bad input or other cases that likely indicate either a bug
+ * or bad configuration (as opposed to a problem with the file being stubbed).
  */
+// TODO add mechanism to force one-off worker
 export async function runInSandbox(entryPath) {
     if (!path.isAbsolute(entryPath)) {
         throw new Error('Entry path must be absolute. Received: ' + entryPath);
@@ -121,92 +93,76 @@ export async function runInSandbox(entryPath) {
     if (!fs.existsSync(entryPath)) {
         throw new Error('Entry path does not exist: ' + entryPath);
     }
-    // Allow code in the sandbox to require files under the requested file's package root,
-    // or under its directory if it's not in a package.
-    const sandboxRoot = findSandboxRoot(entryPath);
-    if (!vms[sandboxRoot]) {
-        if (!cloudpackSandboxRoot) {
-            cloudpackSandboxRoot = findSandboxRoot(filename);
-        }
-        console.debug('esm-stub-utilities: Creating sandbox for ' + sandboxRoot);
+    if (!worker) {
         try {
-            vms[sandboxRoot] = new NodeVM({
-                // disable console logging instead of passing through to the host console
-                console: 'off',
-                // look for these import extensions (mjs is not included because this doesn't support loading ESM)
-                sourceExtensions: ['js', 'cjs'],
-                // use a commonjs module wrapper
-                wrapper: 'commonjs',
-                require: {
-                    // allow local and dependency modules to be required under here
-                    root: [cloudpackSandboxRoot, sandboxRoot],
-                    // load, compile, and require modules in the sandbox (instead of requiring in the host)
-                    context: 'sandbox',
-                    // allowed built-in modules
-                    builtin: allowedBuiltins,
-                    // allow loading "external" modules under the given roots
-                    external: true,
-                    // simulate the browser at startup (can throw errors)
-                    import: [browserEnvSetup],
-                    // fallback resolver if vm2's algorithm fails
-                    resolve: (moduleName, parentDir) => {
-                        // eslint-disable-next-line @ms-cloudpack/internal/no-sync-filesystem
-                        const realParentDir = fs.realpathSync(parentDir);
-                        if (realParentDir === parentDir) {
-                            // Log a more informative error if this isn't a realpath issue (explained below).
-                            // This is clearer than the error message vm2 provides if the file isn't found.
-                            logMissingModule({ moduleName, parentDir, error: 'module not found' });
-                            return undefined;
-                        }
-                        try {
-                            // vm2 doesn't get the realpath of the parent directory before resolving,
-                            // which causes issues with certain install layouts (pnpm, yarn strict).
-                            // Try again using actual require.resolve with the realpath.
-                            return require.resolve(moduleName, { paths: [realParentDir] });
-                        }
-                        catch (err) {
-                            logMissingModule({ moduleName, parentDir, error: String(err), realParentDir });
-                            return undefined;
-                        }
-                    },
-                    // mock these modules so they can be successfully required
-                    mock: {
-                        ...mockBuiltins,
-                        // some modules reference these built-ins during their setup
-                        perf_hooks: {
-                            performance: { now: () => Date.now() },
-                        },
-                        tty: {
-                            isatty: () => false,
-                        },
-                        vm: {
-                            isContext: () => false,
-                        },
-                    },
-                },
-                env: {
-                    // prevent debug from accessing process.stderr
-                    DEBUG_COLORS: 0,
-                },
+            worker = new Worker(workerPath, { stdout: true, stderr: true, execArgv: [] });
+            worker.stdout?.on('data', (data) => {
+                console.debug(`[sandbox stdout] ${data}`);
+            });
+            worker.stderr?.on('data', (data) => {
+                console.debug(`[sandbox stderr] ${data}`);
+            });
+            worker.on('exit', () => {
+                worker = undefined;
             });
+            // don't hold the process open if only the worker is left
+            worker.unref();
         }
         catch (err) {
-            handleError(`initializing sandbox for ${sandboxRoot} (to create stub of ${entryPath})`, err, sandboxRoot);
+            throw new Error(`Error initializing sandbox worker: ${err?.stack || err}`);
         }
     }
-    const onError = (err) => {
-        handleError(`running ${entryPath} in sandbox (to create stub)`, err, sandboxRoot);
-    };
-    process.on('uncaughtException', onError);
-    try {
-        const cjsFile = await fsPromises.readFile(entryPath, 'utf8');
-        return vms[sandboxRoot].run(cjsFile, { filename: entryPath });
-    }
-    catch (err) {
-        onError(err);
-    }
-    finally {
-        process.off('uncaughtException', onError);
-    }
+    return new Promise((resolve, reject) => {
+        // just for type checking
+        if (!worker)
+            return;
+        worker.on('message', onMessage);
+        worker.on('messageerror', onMessageError);
+        worker.on('error', onError);
+        worker.on('exit', onExit);
+        // Send a message requesting the file to be run.
+        worker.postMessage(entryPath);
+        /** Normally, both success and error results should be sent back as messages. */
+        function onMessage(message) {
+            if (message.entryPath !== entryPath) {
+                return; // message about a different file
+            }
+            handlersOff();
+            if (message.exportInfo) {
+                resolve(message.exportInfo);
+            }
+            else if (message.error) {
+                resolve({ error: processError(message.error) });
+            }
+            else {
+                // this indicates a bug in cloudpack
+                reject(new Error(`Unexpected sandbox worker message while running ${entryPath}: ${JSON.stringify(message)}`));
+            }
+        }
+        /** 'messageerror' event: deserializing a message failed. */
+        function onMessageError(err) {
+            handlersOff();
+            reject(new Error(`Error with sandbox worker message serialization while running ${entryPath}: ${err.stack || err}\n`));
+        }
+        /** 'error' event: unhandled exception in the worker, which shouldn't happen. */
+        function onError(err) {
+            handlersOff();
+            reject(new Error(`Uncaught error in sandbox worker while running ${entryPath}: ${err.stack || err}\n`));
+        }
+        /**
+         * Make sure the promise rejects if the worker exits unexpectedly. (This handler is unlikely
+         * to be used because the worker should throw an error if a file calls process.exit().)
+         */
+        function onExit() {
+            reject(new Error(`Sandbox worker exited unexpectedly while running ${entryPath}`));
+        }
+        /** Remove all event handlers to avoid interference with future sandbox runs. */
+        function handlersOff() {
+            worker?.off('message', onMessage);
+            worker?.off('messageerror', onMessageError);
+            worker?.off('error', onError);
+            worker?.off('exit', onExit);
+        }
+    });
 }
 //# sourceMappingURL=runInSandbox.js.map

package/lib/runInSandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"runInSandbox.js","sourceRoot":"","sources":["../src/runInSandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,UAAU,MAAM,aAAa,CAAC;AACrC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAE5D,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AACvC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,8BAA8B,CAAC,CAAC;AAEzF,uDAAuD;AACvD,wFAAwF;AACxF,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAC9E,gGAAgG;AAChG,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAExH,sCAAsC;AACtC,MAAM,GAAG,GAA2B,EAAE,CAAC;AAEvC,6CAA6C;AAC7C,MAAM,YAAY,GAA2B,EAAE,CAAC;AAChD,mEAAmE;AACnE,IAAI,oBAAoB,GAAG,EAAE,CAAC;AAE9B,iDAAiD;AACjD,MAAM,UAAU,mBAAmB;IACjC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,cAAc;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IACvC,IAAI,GAAG,GAAuB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAErD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE;QACtB,+BAA+B;QAC/B,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE;YAC7D,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;SACzB;QAED,IAAI,GAAG,KAAK,IAAI,EAAE;YAChB,mGAAmG;YACnG,uGAAuG;YACvG,sFAAsF;YACtF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACxE,IAAI,gBAAgB,EAAE;gBACpB,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;aAC3B;iBAAM;gBACL,+DAA+D;gBAC/D,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;aAC3D;SACF;QAED,YAAY,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;KACzB;IAED,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,GAAY,EAAE,WAAmB;IACpE,MAAM,OAAO,GAAI,GAAa,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,KAAK,GAAI,GAAa,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1D,mGAAmG;IACnG,MAAM,SAAS,GAAI,GAAa,CAAC,IAAI,CAAC;IAEtC,MAAM,UAAU,GAAG,CAAC,SAAS,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;IAEjD,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,YAAY,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE;QACxF,UAAU,CAAC,IAAI,CACb,EAAE,EACF,kGAAkG;YAChG,yFAAyF,EAC3F,kCAAkC,WAAW,EAAE,EAC/C,+BAA+B,oBAAoB,EAAE,CACtD,CAAC;QAEF,8CAA8C;QAC9C,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACjG,IAAI,UAAU,CAAC,MAAM,EAAE;YACrB,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,0CAA0C,EAAE,GAAG,UAAU,CAAC,CAAC;SAChF;KACF;SAAM,IAAI,SAAS,KAAK,WAAW,EAAE;QACpC,UAAU,CAAC,IAAI,CACb,EAAE,EACF,yFAAyF;YACvF,yFAAyF;YACzF,8DAA8D,CACjE,CAAC;KACH;SAAM,IACL,SAAS,KAAK,aAAa;QAC3B,CAAC,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC;YACjD,OAAO,CAAC,QAAQ,CAAC,4CAA4C,CAAC,CAAC,EACjE;QACA,UAAU,CAAC,IAAI,CACb,EAAE,EACF,kGAAkG;YAChG,mGAAmG,CACtG,CAAC;KACH;IAED,IAAI,KAAK,CAAC,MAAM,EAAE;QAChB,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;IAED,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAwF;IAChH,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IAE/D,oEAAoE;IACpE,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,IAAI,OAAO,IAAI,aAAa,EAAE;QAC5B,qEAAqE;QACrE,MAAM,WAAW,GAAG,YAAY,CAAc,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;QACxF,iBAAiB,GAAG,CAAC,CAAC,CACpB,WAAW,EAAE,gBAAgB,EAAE,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,oBAAoB,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,CAClG,CAAC;KACH;IAED,iEAAiE;IACjE,IAAI,CAAC,iBAAiB,EAAE;QACtB,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,gBAAgB,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,mCAAmC,UAAU,WAAW,SAAS,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC,CAAC;KAC5G;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB;IAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE;QAC/B,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,SAAS,CAAC,CAAC;KACxE;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE;QAC7B,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,SAAS,CAAC,CAAC;KAC5D;IAED,sFAAsF;IACtF,mDAAmD;IACnD,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAE/C,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE;QACrB,IAAI,CAAC,oBAAoB,EAAE;YACzB,oBAAoB,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;SAClD;QAED,OAAO,CAAC,KAAK,CAAC,2CAA2C,GAAG,WAAW,CAAC,CAAC;QAEzE,IAAI;YACF,GAAG,CAAC,WAAW,CAAC,GAAG,IAAI,MAAM,CAAC;gBAC5B,yEAAyE;gBACzE,OAAO,EAAE,KAAK;gBACd,kGAAkG;gBAClG,gBAAgB,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;gBAC/B,gCAAgC;gBAChC,OAAO,EAAE,UAAU;gBACnB,OAAO,EAAE;oBACP,+DAA+D;oBAC/D,IAAI,EAAE,CAAC,oBAAoB,EAAE,WAAW,CAAC;oBACzC,uFAAuF;oBACvF,OAAO,EAAE,SAAS;oBAClB,2BAA2B;oBAC3B,OAAO,EAAE,eAAe;oBACxB,yDAAyD;oBACzD,QAAQ,EAAE,IAAI;oBACd,qDAAqD;oBACrD,MAAM,EAAE,CAAC,eAAe,CAAC;oBACzB,6CAA6C;oBAC7C,OAAO,EAAE,CAAC,UAAkB,EAAE,SAAiB,EAAE,EAAE;wBACjD,qEAAqE;wBACrE,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;wBACjD,IAAI,aAAa,KAAK,SAAS,EAAE;4BAC/B,iFAAiF;4BACjF,+EAA+E;4BAC/E,gBAAgB,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;4BACvE,OAAO,SAAS,CAAC;yBAClB;wBAED,IAAI;4BACF,yEAAyE;4BACzE,wEAAwE;4BACxE,4DAA4D;4BAC5D,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;yBAChE;wBAAC,OAAO,GAAG,EAAE;4BACZ,gBAAgB,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;4BAC/E,OAAO,SAAS,CAAC;yBAClB;oBACH,CAAC;oBACD,0DAA0D;oBAC1D,IAAI,EAAE;wBACJ,GAAG,YAAY;wBACf,4DAA4D;wBAC5D,UAAU,EAAE;4BACV,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE;yBACvC;wBACD,GAAG,EAAE;4BACH,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;yBACpB;wBACD,EAAE,EAAE;4BACF,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK;yBACvB;qBACF;iBACF;gBACD,GAAG,EAAE;oBACH,8CAA8C;oBAC9C,YAAY,EAAE,CAAC;iBAChB;aACF,CAAC,CAAC;SACJ;QAAC,OAAO,GAAG,EAAE;YACZ,WAAW,CAAC,4BAA4B,WAAW,uBAAuB,SAAS,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;SAC3G;KACF;IAED,MAAM,OAAO,GAAG,CAAC,GAAY,EAAE,EAAE;QAC/B,WAAW,CAAC,WAAW,SAAS,8BAA8B,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IACpF,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAEzC,IAAI;QACF,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC7D,OAAO,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAY,CAAC;KAC1E;IAAC,OAAO,GAAG,EAAE;QACZ,OAAO,CAAC,GAAG,CAAC,CAAC;KACd;YAAS;QACR,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;KAC3C;AACH,CAAC","sourcesContent":["import fs from 'fs';\nimport fsPromises from 'fs/promises';\nimport path from 'path';\nimport { builtinModules, createRequire } from 'module';\nimport { fileURLToPath } from 'url';\nimport { NodeVM, VMError } from 'vm2';\nimport type { PackageJson } from '@ms-cloudpack/bundler-types';\nimport { findPackageRoot } from '@ms-cloudpack/path-utilities';\nimport { readJsonSync } from '@ms-cloudpack/json-utilities';\n\nconst require = createRequire(import.meta.url);\nconst filename = fileURLToPath(import.meta.url);\nconst dirname = path.dirname(filename);\nconst browserEnvSetup = path.join(path.dirname(dirname), 'browserEnvironment/index.cjs');\n\n/** Allow the sandbox to load these built-in modules */\n// ('events' and 'stream' export classes which other things extend and can't be proxied)\nconst allowedBuiltins = ['buffer', 'events', 'path', 'stream', 'url', 'util'];\n/** Empty mocks of all built-in modules that aren't allowed (to ensure that requires succeed) */\nconst mockBuiltins = Object.fromEntries(builtinModules.filter((m) => !allowedBuiltins.includes(m)).map((m) => [m, {}]));\n\n/** Mapping from sandbox root to VM */\nconst vms: Record<string, NodeVM> = {};\n\n/** Mapping from directory to sandbox root */\nconst sandboxRoots: Record<string, string> = {};\n/** Sandbox root for this file and other cloudpack-related files */\nlet cloudpackSandboxRoot = '';\n\n/** Reset `vms` and `sandboxRoots` for testing */\nexport function _clearSandboxCaches() {\n  Object.keys(vms).forEach((k) => delete vms[k]);\n  Object.keys(sandboxRoots).forEach((k) => delete sandboxRoots[k]);\n}\n\n/** Get `vms` state for testing */\nexport function _getSandboxVms() {\n  return vms;\n}\n\n/**\n * Try to figure out a root directory where the sandbox should be allowed to require files from.\n * This prefers the git root if found, falling back to package root or parent directory.\n *\n * (This is very likely overly permissive and might be good to restrict in the future.)\n */\nfunction findSandboxRoot(filePath: string) {\n  const root = path.parse(filePath).root;\n  let dir: string | undefined = path.dirname(filePath);\n\n  if (!sandboxRoots[dir]) {\n    // Try to find a git root first\n    while (dir !== root && !fs.existsSync(path.join(dir, '.git'))) {\n      dir = path.dirname(dir);\n    }\n\n    if (dir === root) {\n      // If there's a node_modules segment in the path, take the part before that. This covers two cases:\n      // - The entry file's sandbox when running cloudpack in a dependency package folder within node_modules\n      // - The cloudpack browser environment sandbox when using globally installed cloudpack\n      const nodeModulesMatch = filePath.match(/^(.*?)[\\\\/]node_modules[\\\\/]/);\n      if (nodeModulesMatch) {\n        dir = nodeModulesMatch[1];\n      } else {\n        // Try to find a package root, or fall back to parent directory\n        dir = findPackageRoot(filePath) || path.dirname(filePath);\n      }\n    }\n\n    sandboxRoots[dir] = dir;\n  }\n\n  return sandboxRoots[dir];\n}\n\nfunction handleError(action: string, err: unknown, sandboxRoot: string) {\n  const message = (err as Error).message || String(err);\n  const stack = (err as Error).stack?.split(/\\r?\\n/g) || [];\n  // instanceof checks don't work with errors from code run within the sandbox, but name is preserved\n  const errorName = (err as Error).name;\n\n  const newMessage = [`Error ${action}:`, message];\n\n  if (stack.length && err instanceof VMError && err.message.includes('Cannot find module')) {\n    newMessage.push(\n      '',\n      'Ensure that this file exists on disk. If it exists, this may be a bug with the choice of `root` ' +\n        '(allowed parent directories) settings in @ms-cloudpack/esm-stub-utilities runInSandbox.',\n      `- Root for file being stubbed: ${sandboxRoot}`,\n      `- Root for cloudpack files: ${cloudpackSandboxRoot}`,\n    );\n\n    // Find the actual line which caused the error\n    const errorLines = stack.filter((line) => line.trim().startsWith('at') && !line.includes('vm2'));\n    if (errorLines.length) {\n      newMessage.push('', 'Code that may have required this module:', ...errorLines);\n    }\n  } else if (errorName === 'TypeError') {\n    newMessage.push(\n      '',\n      'If the code was referencing a built-in global or a property of a Node built-in module, ' +\n        'this error may be caused by a missing mock or other issue with the sandbox environment ' +\n        'configured in @ms-cloudpack/esm-stub-utilities runInSandbox.',\n    );\n  } else if (\n    errorName === 'SyntaxError' &&\n    (/Unexpected token '(import|export)'/.test(message) ||\n      message.includes(`'import' and 'export' may appear only with`))\n  ) {\n    newMessage.push(\n      '',\n      \"It appears you're trying to load an ES module, which is not currently supported in the sandbox. \" +\n        'If this module is loaded at startup within a CommonJS file, please file an issue with cloudpack. ',\n    );\n  }\n\n  if (stack.length) {\n    newMessage.push('', 'Original stack:', ...stack.slice(1));\n  }\n\n  throw new Error(newMessage.join('\\n'));\n}\n\nfunction logMissingModule(params: { moduleName: string; parentDir: string; error: string; realParentDir?: string }) {\n  const { moduleName, parentDir, error, realParentDir } = params;\n\n  // First determine if moduleName is from an optional peer dependency\n  let isOptionalPeerDep = false;\n  const depName = moduleName.match(/^(@[\\w.-]+\\/)?[\\w.-]+/)?.[0];\n  const parentPkgRoot = depName ? findPackageRoot(parentDir) : undefined;\n  if (depName && parentPkgRoot) {\n    // eslint-disable-next-line @ms-cloudpack/internal/no-sync-filesystem\n    const packageJson = readJsonSync<PackageJson>(path.join(parentPkgRoot, 'package.json'));\n    isOptionalPeerDep = !!(\n      packageJson?.peerDependencies?.[depName] && packageJson.peerDependenciesMeta?.[depName]?.optional\n    );\n  }\n\n  // If the module is from an optional dep, it's not useful to warn\n  if (!isOptionalPeerDep) {\n    const realPathMsg = realParentDir ? ` (real path: ${realParentDir})` : '';\n    console.warn(`runInSandbox failed to resolve \"${moduleName}\" from \"${parentDir}\"${realPathMsg}: ${error}`);\n  }\n}\n\n/**\n * Run a CommonJS file within a sandboxed environment.\n * @param entryPath - Path to a CommonJS file to run in a sandbox (does not work with ESM files)\n * @returns The module's exports\n */\nexport async function runInSandbox(entryPath: string) {\n  if (!path.isAbsolute(entryPath)) {\n    throw new Error('Entry path must be absolute. Received: ' + entryPath);\n  }\n\n  if (!fs.existsSync(entryPath)) {\n    throw new Error('Entry path does not exist: ' + entryPath);\n  }\n\n  // Allow code in the sandbox to require files under the requested file's package root,\n  // or under its directory if it's not in a package.\n  const sandboxRoot = findSandboxRoot(entryPath);\n\n  if (!vms[sandboxRoot]) {\n    if (!cloudpackSandboxRoot) {\n      cloudpackSandboxRoot = findSandboxRoot(filename);\n    }\n\n    console.debug('esm-stub-utilities: Creating sandbox for ' + sandboxRoot);\n\n    try {\n      vms[sandboxRoot] = new NodeVM({\n        // disable console logging instead of passing through to the host console\n        console: 'off',\n        // look for these import extensions (mjs is not included because this doesn't support loading ESM)\n        sourceExtensions: ['js', 'cjs'],\n        // use a commonjs module wrapper\n        wrapper: 'commonjs',\n        require: {\n          // allow local and dependency modules to be required under here\n          root: [cloudpackSandboxRoot, sandboxRoot],\n          // load, compile, and require modules in the sandbox (instead of requiring in the host)\n          context: 'sandbox',\n          // allowed built-in modules\n          builtin: allowedBuiltins,\n          // allow loading \"external\" modules under the given roots\n          external: true,\n          // simulate the browser at startup (can throw errors)\n          import: [browserEnvSetup],\n          // fallback resolver if vm2's algorithm fails\n          resolve: (moduleName: string, parentDir: string) => {\n            // eslint-disable-next-line @ms-cloudpack/internal/no-sync-filesystem\n            const realParentDir = fs.realpathSync(parentDir);\n            if (realParentDir === parentDir) {\n              // Log a more informative error if this isn't a realpath issue (explained below).\n              // This is clearer than the error message vm2 provides if the file isn't found.\n              logMissingModule({ moduleName, parentDir, error: 'module not found' });\n              return undefined;\n            }\n\n            try {\n              // vm2 doesn't get the realpath of the parent directory before resolving,\n              // which causes issues with certain install layouts (pnpm, yarn strict).\n              // Try again using actual require.resolve with the realpath.\n              return require.resolve(moduleName, { paths: [realParentDir] });\n            } catch (err) {\n              logMissingModule({ moduleName, parentDir, error: String(err), realParentDir });\n              return undefined;\n            }\n          },\n          // mock these modules so they can be successfully required\n          mock: {\n            ...mockBuiltins,\n            // some modules reference these built-ins during their setup\n            perf_hooks: {\n              performance: { now: () => Date.now() },\n            },\n            tty: {\n              isatty: () => false,\n            },\n            vm: {\n              isContext: () => false,\n            },\n          },\n        },\n        env: {\n          // prevent debug from accessing process.stderr\n          DEBUG_COLORS: 0,\n        },\n      });\n    } catch (err) {\n      handleError(`initializing sandbox for ${sandboxRoot} (to create stub of ${entryPath})`, err, sandboxRoot);\n    }\n  }\n\n  const onError = (err: unknown) => {\n    handleError(`running ${entryPath} in sandbox (to create stub)`, err, sandboxRoot);\n  };\n  process.on('uncaughtException', onError);\n\n  try {\n    const cjsFile = await fsPromises.readFile(entryPath, 'utf8');\n    return vms[sandboxRoot].run(cjsFile, { filename: entryPath }) as unknown;\n  } catch (err) {\n    onError(err);\n  } finally {\n    process.off('uncaughtException', onError);\n  }\n}\n"]}
+{"version":3,"file":"runInSandbox.js","sourceRoot":"","sources":["../src/runInSandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAGxC,OAAO,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAC;AAG1D,8EAA8E;AAC9E,MAAM,UAAU,GAAG;IACjB,UAAU,EAAE,iBAAiB;IAC7B,cAAc,EAAE,kBAAkB;CACnC,CAAC;AAEF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAE1D,0BAA0B;AAC1B,IAAI,MAA0B,CAAC;AAE/B,kCAAkC;AAClC,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1B,MAAM,GAAG,SAAS,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CAAC,KAAkD;IACtE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAEjD,IAAI,UAAkB,CAAC;IACvB,IAAI,IAAuB,CAAC;IAE5B,IAAI,IAAI,KAAK,UAAU,CAAC,cAAc,EAAE;QACtC,sFAAsF;QACtF,oCAAoC;QACpC,mBAAmB;QACnB,qBAAqB;QACrB,oBAAoB;QACpB,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,GAAG,kBAAkB,CAAC;KAC3B;SAAM,IAAI,IAAI,KAAK,UAAU,CAAC,UAAU,EAAE;QACzC,sGAAsG;QACtG,iFAAiF;QACjF,kHAAkH;QAClH,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,GAAG,aAAa,CAAC;KACtB;SAAM,IAAI,SAAS,KAAK,aAAa,EAAE;QACtC,UAAU,GAAG,OAAO,CAAC;QACrB,IAAI,GAAG,gBAAgB,CAAC;KACzB;SAAM;QACL,UAAU,GAAG,OAAO,CAAC;QACrB,IAAI,GAAG,aAAa,CAAC;KACtB;IAED,IAAI,KAA2B,CAAC;IAChC,IAAI,KAAK,CAAC,KAAK,EAAE;QACf,sDAAsD;QACtD,KAAK,GAAG,KAAK,CAAC,KAAK;aAChB,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAE9B,gDAAgD;QAChD,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CACjC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CACnF,CAAC;QACF,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE;YACtB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;SACrC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YACjB,KAAK,GAAG,SAAS,CAAC;YAClB,IAAI,IAAI,KAAK,UAAU,CAAC,UAAU,EAAE;gBAClC,sFAAsF;gBACtF,uFAAuF;gBACvF,8CAA8C;gBAC9C,UAAU;oBACR,qFAAqF;wBACrF,2EAA2E,CAAC;gBAC9E,IAAI,GAAG,cAAc,CAAC;aACvB;SACF;KACF;IAED,uCAAuC;IACvC,MAAM,YAAY,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEvE,OAAO;QACL,OAAO,EAAE,UAAU;QACnB,IAAI;QACJ,YAAY,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;KAC9D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB;IAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE;QAC/B,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,SAAS,CAAC,CAAC;KACxE;IACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE;QAC7B,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,SAAS,CAAC,CAAC;KAC5D;IAED,IAAI,CAAC,MAAM,EAAE;QACX,IAAI;YACF,MAAM,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9E,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBACjC,OAAO,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBACjC,OAAO,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;gBACrB,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,yDAAyD;YACzD,MAAM,CAAC,KAAK,EAAE,CAAC;SAChB;QAAC,OAAO,GAAG,EAAE;YACZ,MAAM,IAAI,KAAK,CAAC,sCAAuC,GAAa,EAAE,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;SACvF;KACF;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,yBAAyB;QACzB,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;QAC1C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE1B,gDAAgD;QAChD,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAE9B,gFAAgF;QAChF,SAAS,SAAS,CAAC,OAA8B;YAC/C,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE;gBACnC,OAAO,CAAC,iCAAiC;aAC1C;YAED,WAAW,EAAE,CAAC;YACd,IAAI,OAAO,CAAC,UAAU,EAAE;gBACtB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;aAC7B;iBAAM,IAAI,OAAO,CAAC,KAAK,EAAE;gBACxB,OAAO,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;aACjD;iBAAM;gBACL,oCAAoC;gBACpC,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;aAC/G;QACH,CAAC;QAED,4DAA4D;QAC5D,SAAS,cAAc,CAAC,GAAU;YAChC,WAAW,EAAE,CAAC;YACd,MAAM,CACJ,IAAI,KAAK,CAAC,iEAAiE,SAAS,KAAK,GAAG,CAAC,KAAK,IAAI,GAAG,IAAI,CAAC,CAC/G,CAAC;QACJ,CAAC;QAED,gFAAgF;QAChF,SAAS,OAAO,CAAC,GAAU;YACzB,WAAW,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,KAAK,CAAC,kDAAkD,SAAS,KAAK,GAAG,CAAC,KAAK,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;QAC1G,CAAC;QAED;;;WAGG;QACH,SAAS,MAAM;YACb,MAAM,CAAC,IAAI,KAAK,CAAC,oDAAoD,SAAS,EAAE,CAAC,CAAC,CAAC;QACrF,CAAC;QAED,gFAAgF;QAChF,SAAS,WAAW;YAClB,MAAM,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAClC,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;YAC5C,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import fs from 'fs';\nimport path from 'path';\nimport { fileURLToPath } from 'url';\nimport { Worker } from 'worker_threads';\nimport type { SandboxWorkerResponse } from './types/SandboxWorkerResponse.js';\nimport type { StubExportInfo } from './types/StubExportInfo.js';\nimport { slash } from '@ms-cloudpack/path-string-parsing';\nimport type { StubError } from './types/StubError.js';\n\n/** Some known error codes that can occur when running a file in a sandbox. */\nconst errorCodes = {\n  requireESM: 'ERR_REQUIRE_ESM',\n  moduleNotFound: 'MODULE_NOT_FOUND',\n};\n\nconst dirname = path.dirname(fileURLToPath(import.meta.url));\nconst workerPath = path.join(dirname, 'worker/worker.js');\n\n// TODO do we need a pool?\nlet worker: Worker | undefined;\n\n/** Stop the worker for testing */\nexport async function _stopWorker() {\n  await worker?.terminate();\n  worker = undefined;\n}\n\nfunction processError(error: NonNullable<SandboxWorkerResponse['error']>): StubError {\n  const { message, code, name: errorName } = error;\n\n  let newMessage: string;\n  let type: StubError['type'];\n\n  if (code === errorCodes.moduleNotFound) {\n    // Remove the require stack from MODULE_NOT_FOUND errors (we'll handle it separately).\n    //   Error: Cannot find module 'foo'\n    //   Require stack:\n    //   - [...]/index.js\n    //   - [.]/worker.js\n    newMessage = message.split('\\n')[0];\n    type = 'module-not-found';\n  } else if (code === errorCodes.requireESM) {\n    // Remove the instruction to change to a dynamic import, since it's less likely to be applicable here.\n    //   Error [ERR_REQUIRE_ESM]: require() of ES Module [...]/esm.mjs not supported.\n    //   Instead change the require of [...]/esm.mjs to a dynamic import() which is available in all CommonJS modules.\n    newMessage = message.split('\\n')[0];\n    type = 'require-esm';\n  } else if (errorName === 'SyntaxError') {\n    newMessage = message;\n    type = 'invalid-syntax';\n  } else {\n    newMessage = message;\n    type = 'other-error';\n  }\n\n  let stack: string[] | undefined;\n  if (error.stack) {\n    // Get stack frame lines from the original error stack\n    stack = error.stack\n      .split('\\n')\n      .filter((line) => /^\\s+at /.test(line))\n      .map((line) => line.trim());\n\n    // Remove the worker frame and anything after it\n    const workerIndex = stack.findIndex(\n      (line) => slash(line).includes('esm-stub-utilities') && line.includes('worker.js'),\n    );\n    if (workerIndex !== -1) {\n      stack = stack.slice(0, workerIndex);\n    }\n\n    if (!stack.length) {\n      stack = undefined;\n      if (code === errorCodes.requireESM) {\n        // This error code + no stack outside the worker strongly implies that the file itself\n        // If we ended up with no stack besides the worker, this strongly implies that the file\n        // itself is an ESM file, not a CommonJS file.\n        newMessage =\n          \"It appears you're trying to create a stub of an ES module, which is not supported. \" +\n          'You may need to add a cloudpack override to bundle this package with ori.';\n        type = 'entry-is-esm';\n      }\n    }\n  }\n\n  // Remove node internals from the stack\n  const partialStack = stack?.filter((line) => !line.includes('(node:'));\n\n  return {\n    message: newMessage,\n    type,\n    partialStack: partialStack?.length ? partialStack : undefined,\n  };\n}\n\n/**\n * Run a CommonJS file within a sandboxed environment.\n * @param entryPath - Path to a CommonJS file to run in a sandbox (does not work with ESM files)\n * @returns Info about the file's exports, or error info if there was an issue.\n * Should only throw an error on bad input or other cases that likely indicate either a bug\n * or bad configuration (as opposed to a problem with the file being stubbed).\n */\n// TODO add mechanism to force one-off worker\nexport async function runInSandbox(entryPath: string): Promise<StubExportInfo | { error: StubError }> {\n  if (!path.isAbsolute(entryPath)) {\n    throw new Error('Entry path must be absolute. Received: ' + entryPath);\n  }\n  if (!fs.existsSync(entryPath)) {\n    throw new Error('Entry path does not exist: ' + entryPath);\n  }\n\n  if (!worker) {\n    try {\n      worker = new Worker(workerPath, { stdout: true, stderr: true, execArgv: [] });\n      worker.stdout?.on('data', (data) => {\n        console.debug(`[sandbox stdout] ${data}`);\n      });\n      worker.stderr?.on('data', (data) => {\n        console.debug(`[sandbox stderr] ${data}`);\n      });\n      worker.on('exit', () => {\n        worker = undefined;\n      });\n      // don't hold the process open if only the worker is left\n      worker.unref();\n    } catch (err) {\n      throw new Error(`Error initializing sandbox worker: ${(err as Error)?.stack || err}`);\n    }\n  }\n\n  return new Promise((resolve, reject) => {\n    // just for type checking\n    if (!worker) return;\n\n    worker.on('message', onMessage);\n    worker.on('messageerror', onMessageError);\n    worker.on('error', onError);\n    worker.on('exit', onExit);\n\n    // Send a message requesting the file to be run.\n    worker.postMessage(entryPath);\n\n    /** Normally, both success and error results should be sent back as messages. */\n    function onMessage(message: SandboxWorkerResponse) {\n      if (message.entryPath !== entryPath) {\n        return; // message about a different file\n      }\n\n      handlersOff();\n      if (message.exportInfo) {\n        resolve(message.exportInfo);\n      } else if (message.error) {\n        resolve({ error: processError(message.error) });\n      } else {\n        // this indicates a bug in cloudpack\n        reject(new Error(`Unexpected sandbox worker message while running ${entryPath}: ${JSON.stringify(message)}`));\n      }\n    }\n\n    /** 'messageerror' event: deserializing a message failed. */\n    function onMessageError(err: Error) {\n      handlersOff();\n      reject(\n        new Error(`Error with sandbox worker message serialization while running ${entryPath}: ${err.stack || err}\\n`),\n      );\n    }\n\n    /** 'error' event: unhandled exception in the worker, which shouldn't happen. */\n    function onError(err: Error) {\n      handlersOff();\n      reject(new Error(`Uncaught error in sandbox worker while running ${entryPath}: ${err.stack || err}\\n`));\n    }\n\n    /**\n     * Make sure the promise rejects if the worker exits unexpectedly. (This handler is unlikely\n     * to be used because the worker should throw an error if a file calls process.exit().)\n     */\n    function onExit() {\n      reject(new Error(`Sandbox worker exited unexpectedly while running ${entryPath}`));\n    }\n\n    /** Remove all event handlers to avoid interference with future sandbox runs. */\n    function handlersOff() {\n      worker?.off('message', onMessage);\n      worker?.off('messageerror', onMessageError);\n      worker?.off('error', onError);\n      worker?.off('exit', onExit);\n    }\n  });\n}\n"]}

package/lib/types/SandboxWorkerResponse.d.ts

@@ -0,0 +1,21 @@
+import type { StubExportInfo } from './StubExportInfo.js';
+/**
+ * Success or error IPC message after attempting to run a CJS file in a worker.
+ */
+export interface SandboxWorkerResponse {
+    /** Path to the file that was run */
+    entryPath: string;
+    /** If successful: info about the file's exports */
+    exportInfo?: StubExportInfo;
+    /** If not successful: info about the error that occurred */
+    error?: {
+        /** Message describing the error */
+        message: string;
+        /** If there was an exception: error object name */
+        name?: string;
+        /** If there was an exception: error code (not always set) */
+        code?: string;
+        stack?: string;
+    };
+}
+//# sourceMappingURL=SandboxWorkerResponse.d.ts.map

package/lib/types/SandboxWorkerResponse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SandboxWorkerResponse.d.ts","sourceRoot":"","sources":["../../src/types/SandboxWorkerResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAElB,mDAAmD;IACnD,UAAU,CAAC,EAAE,cAAc,CAAC;IAE5B,4DAA4D;IAC5D,KAAK,CAAC,EAAE;QACN,mCAAmC;QACnC,OAAO,EAAE,MAAM,CAAC;QAChB,mDAAmD;QACnD,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,6DAA6D;QAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH"}

package/lib/types/SandboxWorkerResponse.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=SandboxWorkerResponse.js.map

package/lib/types/SandboxWorkerResponse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SandboxWorkerResponse.js","sourceRoot":"","sources":["../../src/types/SandboxWorkerResponse.ts"],"names":[],"mappings":"","sourcesContent":["import type { StubExportInfo } from './StubExportInfo.js';\n\n/**\n * Success or error IPC message after attempting to run a CJS file in a worker.\n */\nexport interface SandboxWorkerResponse {\n  /** Path to the file that was run */\n  entryPath: string;\n\n  /** If successful: info about the file's exports */\n  exportInfo?: StubExportInfo;\n\n  /** If not successful: info about the error that occurred */\n  error?: {\n    /** Message describing the error */\n    message: string;\n    /** If there was an exception: error object name */\n    name?: string;\n    /** If there was an exception: error code (not always set) */\n    code?: string;\n    stack?: string;\n  };\n}\n"]}

package/lib/types/StubError.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Error that occurred while attempting to create an ESM stub from a CJS or JSON file.
+ */
+export interface StubError {
+    /**
+     * Type of error:
+     * - `module-not-found`: Some file attempted to load a module that wasn't found.
+     * - `require-esm`: Some file attempted to load an ESM module using `require()`.
+     * - `entry-is-esm`: The entry file being stubbed is already ESM.
+     * - `invalid-syntax`: Some loaded file has invalid syntax.
+     * - `other-error`: Anything else.
+     */
+    type: 'module-not-found' | 'require-esm' | 'entry-is-esm' | 'invalid-syntax' | 'other-error';
+    /**
+     * Error message. This will *not* include the path to the file that was being stubbed,
+     * since it's assumed the caller already has this context, and it should be reported as the
+     * file location in the final BundleMessage error.
+     */
+    message: string;
+    /**
+     * Stack from the location of the error down to the file attempting to be stubbed,
+     * omitting frames from Node built-ins. Each line follows the standard stack trace format
+     * `at <function> (<file>:<line>:<column>)` (but with whitespace trimmed).
+     */
+    partialStack?: string[];
+}
+//# sourceMappingURL=StubError.d.ts.map

package/lib/types/StubError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StubError.d.ts","sourceRoot":"","sources":["../../src/types/StubError.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;;OAOG;IACH,IAAI,EAAE,kBAAkB,GAAG,aAAa,GAAG,cAAc,GAAG,gBAAgB,GAAG,aAAa,CAAC;IAE7F;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB"}

package/lib/types/StubError.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=StubError.js.map

package/lib/types/StubError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StubError.js","sourceRoot":"","sources":["../../src/types/StubError.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Error that occurred while attempting to create an ESM stub from a CJS or JSON file.\n */\nexport interface StubError {\n  /**\n   * Type of error:\n   * - `module-not-found`: Some file attempted to load a module that wasn't found.\n   * - `require-esm`: Some file attempted to load an ESM module using `require()`.\n   * - `entry-is-esm`: The entry file being stubbed is already ESM.\n   * - `invalid-syntax`: Some loaded file has invalid syntax.\n   * - `other-error`: Anything else.\n   */\n  type: 'module-not-found' | 'require-esm' | 'entry-is-esm' | 'invalid-syntax' | 'other-error';\n\n  /**\n   * Error message. This will *not* include the path to the file that was being stubbed,\n   * since it's assumed the caller already has this context, and it should be reported as the\n   * file location in the final BundleMessage error.\n   */\n  message: string;\n\n  /**\n   * Stack from the location of the error down to the file attempting to be stubbed,\n   * omitting frames from Node built-ins. Each line follows the standard stack trace format\n   * `at <function> (<file>:<line>:<column>)` (but with whitespace trimmed).\n   */\n  partialStack?: string[];\n}\n"]}

package/lib/types/StubExportInfo.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Information about a CJS module's exports, for purposes of creating a stub.
+ */
+export type StubExportInfo = {
+    /**
+     * Category describing what this module exports (if anything).
+     * - `none`: the module has either set `module.exports = undefined` or deleted `module.exports`
+     */
+    type: 'none';
+} | {
+    /** - `object` or `function` (potentially with other keys set) */
+    type: 'object' | 'function';
+    keys: string[];
+} | {
+    /** - `other`: primitive or array (should just re-export) */
+    type: 'other';
+};
+//# sourceMappingURL=StubExportInfo.d.ts.map

package/lib/types/StubExportInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StubExportInfo.d.ts","sourceRoot":"","sources":["../../src/types/StubExportInfo.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,cAAc,GACtB;IACE;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;CACd,GACD;IACE,iEAAiE;IACjE,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC5B,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB,GACD;IACE,4DAA4D;IAC5D,IAAI,EAAE,OAAO,CAAC;CACf,CAAC"}

package/lib/types/StubExportInfo.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=StubExportInfo.js.map

package/lib/types/StubExportInfo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StubExportInfo.js","sourceRoot":"","sources":["../../src/types/StubExportInfo.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Information about a CJS module's exports, for purposes of creating a stub.\n */\nexport type StubExportInfo =\n  | {\n      /**\n       * Category describing what this module exports (if anything).\n       * - `none`: the module has either set `module.exports = undefined` or deleted `module.exports`\n       */\n      type: 'none';\n    }\n  | {\n      /** - `object` or `function` (potentially with other keys set) */\n      type: 'object' | 'function';\n      keys: string[];\n    }\n  | {\n      /** - `other`: primitive or array (should just re-export) */\n      type: 'other';\n    };\n"]}

package/lib/worker/globals.d.ts

@@ -0,0 +1,8 @@
+/** Get all property descriptor names from the global object. */
+export function getGlobalProperties(): string[];
+/**
+ * Delete any new properties from the global object.
+ * @param {string[]} initialGlobalProperties
+ */
+export function cleanUpGlobals(initialGlobalProperties: string[]): void;
+//# sourceMappingURL=globals.d.ts.map

package/lib/worker/globals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"globals.d.ts","sourceRoot":"","sources":["../../src/worker/globals.js"],"names":[],"mappings":"AAEA,gEAAgE;AAChE,gDAEC;AAED;;;GAGG;AACH,wDAFW,MAAM,EAAE,QAYlB"}

package/lib/worker/globals.js

@@ -0,0 +1,22 @@
+// See worker.js for why this is a JS file.
+/** Get all property descriptor names from the global object. */
+export function getGlobalProperties() {
+    return Object.keys(Object.getOwnPropertyDescriptors(global));
+}
+/**
+ * Delete any new properties from the global object.
+ * @param {string[]} initialGlobalProperties
+ */
+export function cleanUpGlobals(initialGlobalProperties) {
+    Object.entries(Object.getOwnPropertyDescriptors(global)).forEach(([k, desc]) => {
+        if (!initialGlobalProperties.includes(k) && desc.configurable) {
+            try {
+                delete ( /** @type {*} */(global)[k]);
+            }
+            catch {
+                // ignore
+            }
+        }
+    });
+}
+//# sourceMappingURL=globals.js.map

package/lib/worker/globals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"globals.js","sourceRoot":"","sources":["../../src/worker/globals.js"],"names":[],"mappings":"AAAA,2CAA2C;AAE3C,gEAAgE;AAChE,MAAM,UAAU,mBAAmB;IACjC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,uBAAuB;IACpD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE;QAC7E,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE;YAC7D,IAAI;gBACF,OAAO,EAAC,gBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACvC;YAAC,MAAM;gBACN,SAAS;aACV;SACF;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["// See worker.js for why this is a JS file.\n\n/** Get all property descriptor names from the global object. */\nexport function getGlobalProperties() {\n  return Object.keys(Object.getOwnPropertyDescriptors(global));\n}\n\n/**\n * Delete any new properties from the global object.\n * @param {string[]} initialGlobalProperties\n */\nexport function cleanUpGlobals(initialGlobalProperties) {\n  Object.entries(Object.getOwnPropertyDescriptors(global)).forEach(([k, desc]) => {\n    if (!initialGlobalProperties.includes(k) && desc.configurable) {\n      try {\n        delete (/** @type {*} */ (global)[k]);\n      } catch {\n        // ignore\n      }\n    }\n  });\n}\n"]}

package/lib/worker/initBrowserEnvironment.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Initialize a fake browser environment.
+ */
+export function initBrowserEnvironment(): Promise<void>;
+//# sourceMappingURL=initBrowserEnvironment.d.ts.map

package/lib/worker/initBrowserEnvironment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"initBrowserEnvironment.d.ts","sourceRoot":"","sources":["../../src/worker/initBrowserEnvironment.js"],"names":[],"mappings":"AAOA;;GAEG;AACH,wDAiEC"}