almostnode 0.1.0

package/src/npm/resolver.ts

@@ -0,0 +1,385 @@
+/**
+ * Dependency Resolver
+ * Resolves full dependency tree with semver version constraints
+ */
+
+import { Registry, PackageVersion } from './registry';
+
+export interface ResolvedPackage {
+  name: string;
+  version: string;
+  tarballUrl: string;
+  dependencies: Record<string, string>;
+}
+
+export interface ResolveOptions {
+  registry?: Registry;
+  includeDev?: boolean;
+  includeOptional?: boolean;
+  onProgress?: (message: string) => void;
+}
+
+interface ResolveContext {
+  registry: Registry;
+  resolved: Map<string, ResolvedPackage>;
+  resolving: Set<string>;
+  options: ResolveOptions;
+}
+
+/**
+ * Parse a semver version string into components
+ */
+function parseVersion(version: string): {
+  major: number;
+  minor: number;
+  patch: number;
+  prerelease?: string;
+} | null {
+  const match = version.match(/^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/);
+  if (!match) return null;
+
+  return {
+    major: parseInt(match[1], 10),
+    minor: parseInt(match[2], 10),
+    patch: parseInt(match[3], 10),
+    prerelease: match[4],
+  };
+}
+
+/**
+ * Compare two semver versions
+ * Returns: -1 if a < b, 0 if a == b, 1 if a > b
+ */
+function compareVersions(a: string, b: string): number {
+  const parsedA = parseVersion(a);
+  const parsedB = parseVersion(b);
+
+  if (!parsedA || !parsedB) {
+    return a.localeCompare(b);
+  }
+
+  if (parsedA.major !== parsedB.major) {
+    return parsedA.major - parsedB.major;
+  }
+  if (parsedA.minor !== parsedB.minor) {
+    return parsedA.minor - parsedB.minor;
+  }
+  if (parsedA.patch !== parsedB.patch) {
+    return parsedA.patch - parsedB.patch;
+  }
+
+  // Prerelease versions are lower than release versions
+  if (parsedA.prerelease && !parsedB.prerelease) return -1;
+  if (!parsedA.prerelease && parsedB.prerelease) return 1;
+  if (parsedA.prerelease && parsedB.prerelease) {
+    return parsedA.prerelease.localeCompare(parsedB.prerelease);
+  }
+
+  return 0;
+}
+
+/**
+ * Check if a version satisfies a semver range
+ */
+function satisfies(version: string, range: string): boolean {
+  const parsed = parseVersion(version);
+  if (!parsed) return false;
+
+  // Skip prerelease versions unless explicitly requested
+  if (parsed.prerelease && !range.includes('-')) {
+    return false;
+  }
+
+  range = range.trim();
+
+  // Exact version
+  if (/^\d+\.\d+\.\d+/.test(range) && !range.includes(' ')) {
+    const rangeMatch = range.match(/^(\d+\.\d+\.\d+(?:-[^\s]+)?)/);
+    if (rangeMatch) {
+      return compareVersions(version, rangeMatch[1]) === 0;
+    }
+  }
+
+  // Latest or * - any version
+  if (range === '*' || range === 'latest' || range === '') {
+    return true;
+  }
+
+  // Multiple ranges with ||
+  if (range.includes('||')) {
+    return range.split('||').some((r) => satisfies(version, r.trim()));
+  }
+
+  // Range with hyphen: 1.0.0 - 2.0.0
+  if (range.includes(' - ')) {
+    const [min, max] = range.split(' - ').map((s) => s.trim());
+    return compareVersions(version, min) >= 0 && compareVersions(version, max) <= 0;
+  }
+
+  // Compound ranges with operators: >= 2.1.2 < 3.0.0
+  // Parse all operators and versions from the range
+  const operatorMatches = range.match(/(>=|<=|>|<|=)?\s*(\d+\.\d+\.\d+(?:-[^\s]*)?)/g);
+  if (operatorMatches && operatorMatches.length > 1) {
+    return operatorMatches.every((match) => {
+      const m = match.match(/^(>=|<=|>|<|=)?\s*(\d+\.\d+\.\d+(?:-[^\s]*)?)$/);
+      if (!m) return true;
+      const op = m[1] || '=';
+      const ver = m[2];
+      switch (op) {
+        case '>=': return compareVersions(version, ver) >= 0;
+        case '<=': return compareVersions(version, ver) <= 0;
+        case '>': return compareVersions(version, ver) > 0;
+        case '<': return compareVersions(version, ver) < 0;
+        case '=': return compareVersions(version, ver) === 0;
+        default: return compareVersions(version, ver) === 0;
+      }
+    });
+  }
+
+  // Caret range: ^1.2.3 means >=1.2.3 <2.0.0 (or <1.3.0 if major is 0)
+  if (range.startsWith('^')) {
+    const base = range.slice(1);
+    const baseParsed = parseVersion(base);
+    if (!baseParsed) return false;
+
+    if (parsed.major !== baseParsed.major) {
+      return false;
+    }
+
+    if (baseParsed.major === 0) {
+      // ^0.x.y is more restrictive
+      if (baseParsed.minor !== 0 && parsed.minor !== baseParsed.minor) {
+        return false;
+      }
+      if (baseParsed.minor === 0 && parsed.minor !== 0) {
+        return false;
+      }
+    }
+
+    return compareVersions(version, base) >= 0;
+  }
+
+  // Tilde range: ~1.2.3 means >=1.2.3 <1.3.0
+  if (range.startsWith('~')) {
+    const base = range.slice(1);
+    const baseParsed = parseVersion(base);
+    if (!baseParsed) return false;
+
+    if (parsed.major !== baseParsed.major || parsed.minor !== baseParsed.minor) {
+      return false;
+    }
+
+    return compareVersions(version, base) >= 0;
+  }
+
+  // Greater than or equal: >=1.2.3
+  if (range.startsWith('>=')) {
+    const base = range.slice(2).trim();
+    return compareVersions(version, base) >= 0;
+  }
+
+  // Greater than: >1.2.3
+  if (range.startsWith('>')) {
+    const base = range.slice(1).trim();
+    return compareVersions(version, base) > 0;
+  }
+
+  // Less than or equal: <=1.2.3
+  if (range.startsWith('<=')) {
+    const base = range.slice(2).trim();
+    return compareVersions(version, base) <= 0;
+  }
+
+  // Less than: <1.2.3
+  if (range.startsWith('<')) {
+    const base = range.slice(1).trim();
+    return compareVersions(version, base) < 0;
+  }
+
+  // X-ranges: 1.x, 1.2.x, 1, 1.2
+  if (range.includes('x') || range.includes('X') || /^\d+$/.test(range) || /^\d+\.\d+$/.test(range)) {
+    const parts = range.replace(/[xX]/g, '').split('.').filter(Boolean);
+
+    if (parts.length === 1) {
+      return parsed.major === parseInt(parts[0], 10);
+    }
+    if (parts.length === 2) {
+      return (
+        parsed.major === parseInt(parts[0], 10) &&
+        parsed.minor === parseInt(parts[1], 10)
+      );
+    }
+  }
+
+  // Multiple conditions with space (AND) - handle simple cases
+  if (range.includes(' ')) {
+    const conditions = range.split(/\s+/).filter(Boolean);
+    return conditions.every((r) => satisfies(version, r));
+  }
+
+  // Fallback: try exact match
+  return compareVersions(version, range) === 0;
+}
+
+/**
+ * Find the best matching version from available versions
+ */
+function findBestVersion(versions: string[], range: string): string | null {
+  // Sort versions in descending order
+  const sorted = [...versions].sort((a, b) => compareVersions(b, a));
+
+  // Find the first version that satisfies the range
+  for (const version of sorted) {
+    if (satisfies(version, range)) {
+      return version;
+    }
+  }
+
+  return null;
+}
+
+/**
+ * Resolve all dependencies for a package
+ */
+export async function resolveDependencies(
+  packageName: string,
+  versionRange: string = 'latest',
+  options: ResolveOptions = {}
+): Promise<Map<string, ResolvedPackage>> {
+  const registry = options.registry || new Registry();
+  const context: ResolveContext = {
+    registry,
+    resolved: new Map(),
+    resolving: new Set(),
+    options,
+  };
+
+  await resolvePackage(packageName, versionRange, context);
+
+  return context.resolved;
+}
+
+/**
+ * Resolve dependencies from a package.json
+ */
+export async function resolveFromPackageJson(
+  packageJson: {
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+  },
+  options: ResolveOptions = {}
+): Promise<Map<string, ResolvedPackage>> {
+  const registry = options.registry || new Registry();
+  const context: ResolveContext = {
+    registry,
+    resolved: new Map(),
+    resolving: new Set(),
+    options,
+  };
+
+  const deps = { ...packageJson.dependencies };
+
+  if (options.includeDev && packageJson.devDependencies) {
+    Object.assign(deps, packageJson.devDependencies);
+  }
+
+  for (const [name, range] of Object.entries(deps)) {
+    await resolvePackage(name, range, context);
+  }
+
+  return context.resolved;
+}
+
+/**
+ * Recursively resolve a single package and its dependencies
+ */
+async function resolvePackage(
+  packageName: string,
+  versionRange: string,
+  context: ResolveContext
+): Promise<void> {
+  const { registry, resolved, resolving, options } = context;
+
+  // Create a key for this package request
+  const key = `${packageName}@${versionRange}`;
+
+  // Check if we're already resolving this (circular dependency)
+  if (resolving.has(key)) {
+    return;
+  }
+
+  // Check if we've already resolved a compatible version
+  if (resolved.has(packageName)) {
+    const existing = resolved.get(packageName)!;
+    if (satisfies(existing.version, versionRange)) {
+      return;
+    }
+    // If existing version doesn't satisfy, we might need nested deps
+    // For MVP, we'll just use the existing version (flat node_modules)
+    return;
+  }
+
+  resolving.add(key);
+
+  try {
+    options.onProgress?.(`Resolving ${packageName}@${versionRange}`);
+
+    // Fetch package manifest
+    const manifest = await registry.getPackageManifest(packageName);
+
+    // Find best matching version
+    const versions = Object.keys(manifest.versions);
+    let targetVersion: string;
+
+    if (versionRange === 'latest' || versionRange === '*') {
+      targetVersion = manifest['dist-tags'].latest;
+    } else if (manifest['dist-tags'][versionRange]) {
+      targetVersion = manifest['dist-tags'][versionRange];
+    } else {
+      const best = findBestVersion(versions, versionRange);
+      if (!best) {
+        throw new Error(
+          `No matching version found for ${packageName}@${versionRange}`
+        );
+      }
+      targetVersion = best;
+    }
+
+    // Get version metadata
+    const versionData = manifest.versions[targetVersion];
+
+    // Store resolved package
+    const resolvedPackage: ResolvedPackage = {
+      name: packageName,
+      version: targetVersion,
+      tarballUrl: versionData.dist.tarball,
+      dependencies: versionData.dependencies || {},
+    };
+
+    resolved.set(packageName, resolvedPackage);
+
+    // Resolve dependencies in parallel
+    const deps = { ...versionData.dependencies };
+
+    if (options.includeOptional && versionData.optionalDependencies) {
+      Object.assign(deps, versionData.optionalDependencies);
+    }
+
+    const depEntries = Object.entries(deps);
+    if (depEntries.length > 0) {
+      // Resolve dependencies in parallel batches
+      const CONCURRENCY = 8;
+      for (let i = 0; i < depEntries.length; i += CONCURRENCY) {
+        const batch = depEntries.slice(i, i + CONCURRENCY);
+        await Promise.all(
+          batch.map(([depName, depRange]) => resolvePackage(depName, depRange, context))
+        );
+      }
+    }
+  } finally {
+    resolving.delete(key);
+  }
+}
+
+// Export utilities for testing
+export { parseVersion, compareVersions, satisfies, findBestVersion };

package/src/npm/tarball.ts

@@ -0,0 +1,209 @@
+/**
+ * Tarball Extractor
+ * Downloads and extracts npm package tarballs into the virtual file system
+ */
+
+import pako from 'pako';
+import { VirtualFS } from '../virtual-fs';
+import * as path from '../shims/path';
+
+export interface ExtractOptions {
+  stripComponents?: number; // Number of leading path components to strip (default: 1 for npm's "package/" prefix)
+  filter?: (path: string) => boolean;
+  onProgress?: (message: string) => void;
+}
+
+interface TarEntry {
+  name: string;
+  type: 'file' | 'directory' | 'symlink' | 'unknown';
+  size: number;
+  mode: number;
+  content?: Uint8Array;
+  linkTarget?: string;
+}
+
+/**
+ * Parse a tar archive from raw bytes
+ */
+function* parseTar(data: Uint8Array): Generator<TarEntry> {
+  const decoder = new TextDecoder();
+  let offset = 0;
+
+  while (offset < data.length - 512) {
+    // Read 512-byte header
+    const header = data.slice(offset, offset + 512);
+    offset += 512;
+
+    // Check for end of archive (two zero blocks)
+    if (header.every((b) => b === 0)) {
+      break;
+    }
+
+    // Parse header fields
+    const name = parseString(header, 0, 100);
+    const mode = parseOctal(header, 100, 8);
+    const size = parseOctal(header, 124, 12);
+    const typeFlag = String.fromCharCode(header[156]);
+    const linkName = parseString(header, 157, 100);
+    const prefix = parseString(header, 345, 155);
+
+    // Skip empty entries
+    if (!name) {
+      continue;
+    }
+
+    // Combine prefix and name for long paths
+    const fullName = prefix ? `${prefix}/${name}` : name;
+
+    // Determine entry type
+    let type: TarEntry['type'];
+    switch (typeFlag) {
+      case '0':
+      case '\0':
+      case '':
+        type = 'file';
+        break;
+      case '5':
+        type = 'directory';
+        break;
+      case '1':
+      case '2':
+        type = 'symlink';
+        break;
+      default:
+        type = 'unknown';
+    }
+
+    // Read file content
+    let content: Uint8Array | undefined;
+    if (type === 'file' && size > 0) {
+      content = data.slice(offset, offset + size);
+      // Move past content, rounded up to 512-byte boundary
+      offset += Math.ceil(size / 512) * 512;
+    }
+
+    yield {
+      name: fullName,
+      type,
+      size,
+      mode,
+      content,
+      linkTarget: type === 'symlink' ? linkName : undefined,
+    };
+  }
+}
+
+/**
+ * Parse a null-terminated string from tar header
+ */
+function parseString(data: Uint8Array, offset: number, length: number): string {
+  const bytes = data.slice(offset, offset + length);
+  const nullIndex = bytes.indexOf(0);
+  const actualBytes = nullIndex >= 0 ? bytes.slice(0, nullIndex) : bytes;
+  return new TextDecoder().decode(actualBytes);
+}
+
+/**
+ * Parse an octal number from tar header
+ */
+function parseOctal(data: Uint8Array, offset: number, length: number): number {
+  const str = parseString(data, offset, length).trim();
+  return parseInt(str, 8) || 0;
+}
+
+/**
+ * Decompress gzipped data
+ */
+export function decompress(data: ArrayBuffer | Uint8Array): Uint8Array {
+  const input = data instanceof Uint8Array ? data : new Uint8Array(data);
+  return pako.inflate(input);
+}
+
+/**
+ * Extract a tarball to the virtual file system
+ */
+export function extractTarball(
+  tarballData: ArrayBuffer | Uint8Array,
+  vfs: VirtualFS,
+  destPath: string,
+  options: ExtractOptions = {}
+): string[] {
+  const { stripComponents = 1, filter, onProgress } = options;
+
+  // Decompress gzip
+  onProgress?.('Decompressing...');
+  const tarData = decompress(tarballData);
+
+  // Parse and extract tar entries
+  const extractedFiles: string[] = [];
+
+  for (const entry of parseTar(tarData)) {
+    // Skip non-file/directory entries for now
+    if (entry.type !== 'file' && entry.type !== 'directory') {
+      continue;
+    }
+
+    // Strip leading path components (npm packages have "package/" prefix)
+    let entryPath = entry.name;
+    if (stripComponents > 0) {
+      const parts = entryPath.split('/').filter(Boolean);
+      if (parts.length <= stripComponents) {
+        continue;
+      }
+      entryPath = parts.slice(stripComponents).join('/');
+    }
+
+    // Apply filter if provided
+    if (filter && !filter(entryPath)) {
+      continue;
+    }
+
+    // Build destination path
+    const fullPath = path.join(destPath, entryPath);
+
+    if (entry.type === 'directory') {
+      vfs.mkdirSync(fullPath, { recursive: true });
+    } else if (entry.type === 'file' && entry.content) {
+      // Ensure parent directory exists
+      const parentDir = path.dirname(fullPath);
+      vfs.mkdirSync(parentDir, { recursive: true });
+
+      // Write file
+      vfs.writeFileSync(fullPath, entry.content);
+      extractedFiles.push(fullPath);
+    }
+  }
+
+  onProgress?.(`Extracted ${extractedFiles.length} files`);
+
+  return extractedFiles;
+}
+
+/**
+ * Download and extract a tarball from URL
+ */
+export async function downloadAndExtract(
+  url: string,
+  vfs: VirtualFS,
+  destPath: string,
+  options: ExtractOptions = {}
+): Promise<string[]> {
+  const { onProgress } = options;
+
+  onProgress?.(`Downloading ${url}...`);
+
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`Failed to download tarball: ${response.status}`);
+  }
+
+  const data = await response.arrayBuffer();
+
+  return extractTarball(data, vfs, destPath, options);
+}
+
+export default {
+  decompress,
+  extractTarball,
+  downloadAndExtract,
+};

package/src/runtime-interface.ts

@@ -0,0 +1,103 @@
+/**
+ * Runtime Interface - Common interface for main-thread and worker runtimes
+ */
+
+import type { VirtualFS } from './virtual-fs';
+
+export interface IRuntimeOptions {
+  cwd?: string;
+  env?: Record<string, string>;
+  onConsole?: (method: string, args: unknown[]) => void;
+}
+
+export interface IModule {
+  id: string;
+  filename: string;
+  exports: unknown;
+  loaded: boolean;
+  children: IModule[];
+  paths: string[];
+}
+
+export interface IExecuteResult {
+  exports: unknown;
+  module: IModule;
+}
+
+/**
+ * Common runtime interface implemented by both MainThreadRuntime and WorkerRuntime
+ */
+export interface IRuntime {
+  /**
+   * Execute code as a module
+   */
+  execute(code: string, filename?: string): Promise<IExecuteResult>;
+
+  /**
+   * Run a file from the virtual file system
+   */
+  runFile(filename: string): Promise<IExecuteResult>;
+
+  /**
+   * Clear the module cache
+   */
+  clearCache(): void;
+
+  /**
+   * Get the virtual file system (only available on main thread runtime)
+   */
+  getVFS?(): VirtualFS;
+
+  /**
+   * Terminate the runtime (only applicable to worker runtime)
+   */
+  terminate?(): void;
+}
+
+/**
+ * Options for creating a runtime
+ */
+export interface CreateRuntimeOptions extends IRuntimeOptions {
+  /**
+   * Cross-origin sandbox URL for secure code execution.
+   * When set, code runs in a cross-origin iframe, providing browser-enforced
+   * isolation from cookies, localStorage, and IndexedDB.
+   *
+   * Example: 'https://myapp-sandbox.vercel.app'
+   */
+  sandbox?: string;
+
+  /**
+   * Explicitly allow same-origin execution (less secure).
+   * Required when not using sandbox mode.
+   *
+   * WARNING: Same-origin execution allows untrusted code to access
+   * cookies, localStorage, and other same-origin resources.
+   * Only use this for trusted code or demos.
+   */
+  dangerouslyAllowSameOrigin?: boolean;
+
+  /**
+   * Whether to use a Web Worker for code execution (same-origin only)
+   * - false (default): Execute on main thread
+   * - true: Execute in a Web Worker
+   * - 'auto': Use worker if available, fallback to main thread
+   *
+   * Note: Workers provide thread isolation but NOT origin isolation.
+   * They still have access to IndexedDB and can make network requests.
+   */
+  useWorker?: boolean | 'auto';
+}
+
+/**
+ * VFS snapshot for transferring to worker
+ */
+export interface VFSSnapshot {
+  files: VFSFileEntry[];
+}
+
+export interface VFSFileEntry {
+  path: string;
+  type: 'file' | 'directory';
+  content?: string; // base64 encoded for binary files
+}