sandboxedjs 0.1.2 → 0.1.3

package/dist/index.cjs

@@ -4044,6 +4044,294 @@ var init_builtins = __esm({
   }
 });
 
+// src/util/binary.ts
+var isNode = typeof process !== "undefined" && process.versions != null && process.versions.node != null;
+async function nodeBuiltin(name) {
+  const specifier = `node:${name}`;
+  return await import(
+    /* @vite-ignore */
+    /* webpackIgnore: true */
+    specifier
+  );
+}
+var zlibPromise = null;
+function nodeZlib() {
+  zlibPromise ??= nodeBuiltin("zlib");
+  return zlibPromise;
+}
+async function throughStream(data, stream) {
+  const source = new Blob([data]).stream();
+  const piped = source.pipeThrough(stream);
+  return new Uint8Array(await new Response(piped).arrayBuffer());
+}
+async function gzip(data) {
+  if (isNode) return new Uint8Array((await nodeZlib()).gzipSync(data));
+  return throughStream(data, new CompressionStream("gzip"));
+}
+async function gunzip(data) {
+  if (isNode) return new Uint8Array((await nodeZlib()).gunzipSync(data));
+  return throughStream(data, new DecompressionStream("gzip"));
+}
+async function deflate(data) {
+  if (isNode) return new Uint8Array((await nodeZlib()).deflateSync(data));
+  return throughStream(data, new CompressionStream("deflate"));
+}
+async function inflate(data) {
+  if (isNode) return new Uint8Array((await nodeZlib()).inflateSync(data));
+  return throughStream(data, new DecompressionStream("deflate"));
+}
+async function inflateRaw(data) {
+  if (isNode) return new Uint8Array((await nodeZlib()).inflateRawSync(data));
+  return throughStream(data, new DecompressionStream("deflate-raw"));
+}
+var cryptoPromise = null;
+function nodeCrypto() {
+  cryptoPromise ??= nodeBuiltin("crypto");
+  return cryptoPromise;
+}
+var SUBTLE_NAMES = {
+  sha1: "SHA-1",
+  sha256: "SHA-256",
+  sha384: "SHA-384",
+  sha512: "SHA-512"
+};
+var UnsupportedAlgorithmError = class extends Error {
+  constructor(algorithm) {
+    super(`${algorithm} is not available in this environment`);
+    this.name = "UnsupportedAlgorithmError";
+  }
+};
+async function digestHex(algorithm, data) {
+  if (isNode) {
+    const { createHash } = await nodeCrypto();
+    return createHash(algorithm).update(data).digest("hex");
+  }
+  if (algorithm === "md5") return md5Hex(data);
+  const name = SUBTLE_NAMES[algorithm];
+  if (!name) throw new UnsupportedAlgorithmError(algorithm);
+  const buffer = await crypto.subtle.digest(name, data);
+  return toHex(new Uint8Array(buffer));
+}
+async function randomUuid() {
+  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return crypto.randomUUID();
+  const { randomUUID } = await nodeCrypto();
+  return randomUUID();
+}
+function toHex(bytes) {
+  let out = "";
+  for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
+  return out;
+}
+function md5Hex(input) {
+  const S = [
+    7,
+    12,
+    17,
+    22,
+    7,
+    12,
+    17,
+    22,
+    7,
+    12,
+    17,
+    22,
+    7,
+    12,
+    17,
+    22,
+    5,
+    9,
+    14,
+    20,
+    5,
+    9,
+    14,
+    20,
+    5,
+    9,
+    14,
+    20,
+    5,
+    9,
+    14,
+    20,
+    4,
+    11,
+    16,
+    23,
+    4,
+    11,
+    16,
+    23,
+    4,
+    11,
+    16,
+    23,
+    4,
+    11,
+    16,
+    23,
+    6,
+    10,
+    15,
+    21,
+    6,
+    10,
+    15,
+    21,
+    6,
+    10,
+    15,
+    21,
+    6,
+    10,
+    15,
+    21
+  ];
+  const K = new Uint32Array(64);
+  for (let i = 0; i < 64; i++) K[i] = Math.floor(Math.abs(Math.sin(i + 1)) * 2 ** 32);
+  const bitLength = input.length * 8;
+  const padded = new Uint8Array(((input.length + 8 >> 6) + 1) * 64);
+  padded.set(input);
+  padded[input.length] = 128;
+  const view = new DataView(padded.buffer);
+  view.setUint32(padded.length - 8, bitLength >>> 0, true);
+  view.setUint32(padded.length - 4, Math.floor(bitLength / 2 ** 32), true);
+  let a0 = 1732584193;
+  let b0 = 4023233417;
+  let c0 = 2562383102;
+  let d0 = 271733878;
+  for (let chunk = 0; chunk < padded.length; chunk += 64) {
+    const M = new Uint32Array(16);
+    for (let i = 0; i < 16; i++) M[i] = view.getUint32(chunk + i * 4, true);
+    let [a, b, c, d] = [a0, b0, c0, d0];
+    for (let i = 0; i < 64; i++) {
+      let f;
+      let g;
+      if (i < 16) {
+        f = b & c | ~b & d;
+        g = i;
+      } else if (i < 32) {
+        f = d & b | ~d & c;
+        g = (5 * i + 1) % 16;
+      } else if (i < 48) {
+        f = b ^ c ^ d;
+        g = (3 * i + 5) % 16;
+      } else {
+        f = c ^ (b | ~d);
+        g = 7 * i % 16;
+      }
+      const tmp = d;
+      d = c;
+      c = b;
+      const sum = a + f + K[i] + M[g] >>> 0;
+      b = b + (sum << S[i] | sum >>> 32 - S[i]) >>> 0;
+      a = tmp;
+    }
+    a0 = a0 + a >>> 0;
+    b0 = b0 + b >>> 0;
+    c0 = c0 + c >>> 0;
+    d0 = d0 + d >>> 0;
+  }
+  const out = new Uint8Array(16);
+  new DataView(out.buffer).setUint32(0, a0, true);
+  new DataView(out.buffer).setUint32(4, b0, true);
+  new DataView(out.buffer).setUint32(8, c0, true);
+  new DataView(out.buffer).setUint32(12, d0, true);
+  return toHex(out);
+}
+
+// src/runtime/esbuild-host.ts
+var INITIALIZE_CALLS = /\.initialize\(\s*\{\s*wasmURL:[^}]*\}\s*\)/g;
+var installed = null;
+function installEsbuildRuntime() {
+  installed ??= install().catch((error) => {
+    if (process.env.SANDBOXEDJS_DEBUG) {
+      console.error("[sandboxedjs] esbuild runtime unavailable:", error);
+    }
+  });
+  return installed;
+}
+async function install() {
+  const workerPath = await buildPatchedWorker();
+  if (!workerPath) return;
+  const { createNodeHost, setRuntimeHost } = await import('@scelar/nodepod/headless');
+  setRuntimeHost(createNodeHost({ workerPath }));
+}
+async function buildPatchedWorker() {
+  const { createRequire } = await nodeBuiltin("module");
+  const fs = await nodeBuiltin("fs/promises");
+  const os = await nodeBuiltin("os");
+  const path = await nodeBuiltin("path");
+  const url = await nodeBuiltin("url");
+  const crypto2 = await nodeBuiltin("crypto");
+  const require2 = createRequire(path.join(process.cwd(), "index.js"));
+  let workerPath;
+  let wasmPath;
+  let browserEntry;
+  try {
+    workerPath = path.join(
+      path.dirname(require2.resolve("@scelar/nodepod/headless")),
+      "__worker__.js"
+    );
+    const esbuildRoot = path.dirname(require2.resolve("esbuild-wasm/package.json"));
+    wasmPath = path.join(esbuildRoot, "esbuild.wasm");
+    browserEntry = path.join(esbuildRoot, "esm", "browser.min.js");
+  } catch {
+    return null;
+  }
+  const [source, wasmStat] = await Promise.all([
+    fs.readFile(workerPath, "utf8"),
+    fs.stat(wasmPath)
+  ]);
+  if (!INITIALIZE_CALLS.test(source)) {
+    return null;
+  }
+  INITIALIZE_CALLS.lastIndex = 0;
+  const WASM_URL = /`https:\/\/esm\.sh\/esbuild-wasm@\$\{[A-Za-z0-9_$]+\}\/esbuild\.wasm`/g;
+  const MODULE_URL = /`https:\/\/esm\.sh\/esbuild-wasm@\$\{[A-Za-z0-9_$]+\}`/g;
+  const initCall = `.initialize(await __sandboxedjsEsbuildInit(${JSON.stringify(wasmPath)}, ${JSON.stringify(url.pathToFileURL(wasmPath).href)}))`;
+  const patched = [
+    // The helper is needed by the bundle itself and again inside the nested
+    // worker it builds from a template, which is a separate script.
+    INIT_HELPER,
+    source.replace(WASM_URL, JSON.stringify(url.pathToFileURL(wasmPath).href)).replace(MODULE_URL, JSON.stringify(url.pathToFileURL(browserEntry).href)).replace(INITIALIZE_CALLS, initCall).replace("function ensureEsbuild() {", `${INIT_HELPER}
+
+function ensureEsbuild() {`)
+  ].join("\n");
+  const fingerprint = crypto2.createHash("sha256").update(`${source.length}:${wasmStat.size}:${patched.length}`).digest("hex").slice(0, 16);
+  const cached = path.join(os.tmpdir(), `sandboxedjs-worker-${fingerprint}.js`);
+  try {
+    await fs.access(cached);
+  } catch {
+    const staging = `${cached}.${process.pid}.tmp`;
+    await fs.writeFile(staging, patched, "utf8");
+    await fs.rename(staging, cached);
+  }
+  return cached;
+}
+var INIT_HELPER = `let __sandboxedjsWasmUrl = null;
+async function __sandboxedjsEsbuildInit(wasmPath, wasmUrl) {
+  // esbuild-wasm is a browser build: it resolves its wasm against document
+  // location. There is no document here, and a bare origin is enough.
+  if (typeof globalThis.location === "undefined") {
+    globalThis.location = { href: "file:///", origin: "null", protocol: "file:" };
+  }
+  // esbuild-wasm fetches its wasm, and fetch cannot read a file: URL, so the
+  // bytes are inlined as a data: URL instead \u2014 the one scheme both the ESM
+  // loader and fetch accept. Built once and reused; it is ~15MB of base64.
+  // Handing over a pre-compiled WebAssembly.Module instead does not work: the
+  // Go glue supplies its own import object and rejects a foreign module.
+  try {
+    if (__sandboxedjsWasmUrl === null && typeof require === "function") {
+      const bytes = require("node:fs").readFileSync(wasmPath);
+      __sandboxedjsWasmUrl = "data:application/wasm;base64," + bytes.toString("base64");
+    }
+  } catch (err) { /* fall back to the file URL below */ }
+  return { wasmURL: __sandboxedjsWasmUrl || wasmUrl, worker: false };
+}`;
+
 // src/fs/vfs.ts
 init_errno();
 init_path();
@@ -15136,206 +15424,6 @@ var commands5 = [grep, find, xargs, diff, cmp];
 // src/bin/archive.ts
 init_mode();
 init_path();
-
-// src/util/binary.ts
-var isNode = typeof process !== "undefined" && process.versions != null && process.versions.node != null;
-async function nodeBuiltin(name) {
-  const specifier = `node:${name}`;
-  return await import(
-    /* @vite-ignore */
-    /* webpackIgnore: true */
-    specifier
-  );
-}
-var zlibPromise = null;
-function nodeZlib() {
-  zlibPromise ??= nodeBuiltin("zlib");
-  return zlibPromise;
-}
-async function throughStream(data, stream) {
-  const source = new Blob([data]).stream();
-  const piped = source.pipeThrough(stream);
-  return new Uint8Array(await new Response(piped).arrayBuffer());
-}
-async function gzip(data) {
-  if (isNode) return new Uint8Array((await nodeZlib()).gzipSync(data));
-  return throughStream(data, new CompressionStream("gzip"));
-}
-async function gunzip(data) {
-  if (isNode) return new Uint8Array((await nodeZlib()).gunzipSync(data));
-  return throughStream(data, new DecompressionStream("gzip"));
-}
-async function deflate(data) {
-  if (isNode) return new Uint8Array((await nodeZlib()).deflateSync(data));
-  return throughStream(data, new CompressionStream("deflate"));
-}
-async function inflate(data) {
-  if (isNode) return new Uint8Array((await nodeZlib()).inflateSync(data));
-  return throughStream(data, new DecompressionStream("deflate"));
-}
-async function inflateRaw(data) {
-  if (isNode) return new Uint8Array((await nodeZlib()).inflateRawSync(data));
-  return throughStream(data, new DecompressionStream("deflate-raw"));
-}
-var cryptoPromise = null;
-function nodeCrypto() {
-  cryptoPromise ??= nodeBuiltin("crypto");
-  return cryptoPromise;
-}
-var SUBTLE_NAMES = {
-  sha1: "SHA-1",
-  sha256: "SHA-256",
-  sha384: "SHA-384",
-  sha512: "SHA-512"
-};
-var UnsupportedAlgorithmError = class extends Error {
-  constructor(algorithm) {
-    super(`${algorithm} is not available in this environment`);
-    this.name = "UnsupportedAlgorithmError";
-  }
-};
-async function digestHex(algorithm, data) {
-  if (isNode) {
-    const { createHash } = await nodeCrypto();
-    return createHash(algorithm).update(data).digest("hex");
-  }
-  if (algorithm === "md5") return md5Hex(data);
-  const name = SUBTLE_NAMES[algorithm];
-  if (!name) throw new UnsupportedAlgorithmError(algorithm);
-  const buffer = await crypto.subtle.digest(name, data);
-  return toHex(new Uint8Array(buffer));
-}
-async function randomUuid() {
-  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return crypto.randomUUID();
-  const { randomUUID } = await nodeCrypto();
-  return randomUUID();
-}
-function toHex(bytes) {
-  let out = "";
-  for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
-  return out;
-}
-function md5Hex(input) {
-  const S = [
-    7,
-    12,
-    17,
-    22,
-    7,
-    12,
-    17,
-    22,
-    7,
-    12,
-    17,
-    22,
-    7,
-    12,
-    17,
-    22,
-    5,
-    9,
-    14,
-    20,
-    5,
-    9,
-    14,
-    20,
-    5,
-    9,
-    14,
-    20,
-    5,
-    9,
-    14,
-    20,
-    4,
-    11,
-    16,
-    23,
-    4,
-    11,
-    16,
-    23,
-    4,
-    11,
-    16,
-    23,
-    4,
-    11,
-    16,
-    23,
-    6,
-    10,
-    15,
-    21,
-    6,
-    10,
-    15,
-    21,
-    6,
-    10,
-    15,
-    21,
-    6,
-    10,
-    15,
-    21
-  ];
-  const K = new Uint32Array(64);
-  for (let i = 0; i < 64; i++) K[i] = Math.floor(Math.abs(Math.sin(i + 1)) * 2 ** 32);
-  const bitLength = input.length * 8;
-  const padded = new Uint8Array(((input.length + 8 >> 6) + 1) * 64);
-  padded.set(input);
-  padded[input.length] = 128;
-  const view = new DataView(padded.buffer);
-  view.setUint32(padded.length - 8, bitLength >>> 0, true);
-  view.setUint32(padded.length - 4, Math.floor(bitLength / 2 ** 32), true);
-  let a0 = 1732584193;
-  let b0 = 4023233417;
-  let c0 = 2562383102;
-  let d0 = 271733878;
-  for (let chunk = 0; chunk < padded.length; chunk += 64) {
-    const M = new Uint32Array(16);
-    for (let i = 0; i < 16; i++) M[i] = view.getUint32(chunk + i * 4, true);
-    let [a, b, c, d] = [a0, b0, c0, d0];
-    for (let i = 0; i < 64; i++) {
-      let f;
-      let g;
-      if (i < 16) {
-        f = b & c | ~b & d;
-        g = i;
-      } else if (i < 32) {
-        f = d & b | ~d & c;
-        g = (5 * i + 1) % 16;
-      } else if (i < 48) {
-        f = b ^ c ^ d;
-        g = (3 * i + 5) % 16;
-      } else {
-        f = c ^ (b | ~d);
-        g = 7 * i % 16;
-      }
-      const tmp = d;
-      d = c;
-      c = b;
-      const sum = a + f + K[i] + M[g] >>> 0;
-      b = b + (sum << S[i] | sum >>> 32 - S[i]) >>> 0;
-      a = tmp;
-    }
-    a0 = a0 + a >>> 0;
-    b0 = b0 + b >>> 0;
-    c0 = c0 + c >>> 0;
-    d0 = d0 + d >>> 0;
-  }
-  const out = new Uint8Array(16);
-  new DataView(out.buffer).setUint32(0, a0, true);
-  new DataView(out.buffer).setUint32(4, b0, true);
-  new DataView(out.buffer).setUint32(8, c0, true);
-  new DataView(out.buffer).setUint32(12, d0, true);
-  return toHex(out);
-}
-
-// src/bin/archive.ts
 var BLOCK = 512;
 var encoder4 = new TextEncoder();
 var decoder6 = new TextDecoder();
@@ -16643,7 +16731,7 @@ var watch = defineCommand({
     return 0;
   }
 });
-var install = defineCommand({
+var install2 = defineCommand({
   name: "install",
   path: "/usr/bin/install",
   summary: "copy files and set attributes",
@@ -16762,7 +16850,7 @@ var commands9 = [
   timeoutCmd,
   nohup,
   watch,
-  install,
+  install2,
   niceCmd,
   timeCmd
 ];
@@ -18588,12 +18676,12 @@ unless the container was created with network: { allowOutbound: true }.`,
     }
     ctx.stderr.write(`npx: installing ${packageSpec}...
 `);
-    const installed = await installPackages(ctx, [packageSpec], {
+    const installed2 = await installPackages(ctx, [packageSpec], {
       cwd: root,
       save: false,
       quiet: true
     });
-    if (installed !== 0) return installed;
+    if (installed2 !== 0) return installed2;
     if (!findLocalBin(ctx, command)) {
       const binaries = packageBinaries(ctx, root, packageName);
       const chosen = binaries.includes(command) ? command : binaries[0];
@@ -19022,6 +19110,7 @@ var Container = class _Container {
   }
   // ── boot ──────────────────────────────────────────────────────────────────
   static async create(opts = {}) {
+    if (!opts.pod) await installEsbuildRuntime();
     const pod = opts.pod ?? await headless.Nodepod.boot({
       headless: true,
       serviceWorker: false,